The iwlwifi driver in the Linux kernel builds a probe request for scheduled scans before it validates that the combined length of the information elements (IEs) fits in the destination buffer. Because the size check occurs after the copy, an attacker can supply an IE that is too large, causing a buffer overflow into the probe‑request buffer. This memory corruption can lead to a kernel panic or other disruption of the wireless subsystem. The vulnerability is classified as a stack or heap overflow (CWE‑120).

The flaw exists in all Linux kernel releases that include the iwlwifi driver prior to the commit that introduced the size‑validation fix. The affected code is part of the iwlwifi driver, which is used for Intel wireless hardware. Any Linux distribution running a kernel without the patch is potentially impacted. No explicit version range is supplied, so users should verify whether their kernel contains the commit that applied the fix.

The CVSS score of 7.8 indicates a moderate‑to‑high severity for a kernel memory overwrite. The EPSS score of <1% indicates a low likelihood of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to require the ability to trigger a scheduled scan with a crafted oversized IE, which would typically require local access to the wireless interface or a remote adversary able to influence scan parameters. As no public exploit is known, the risk to remote users remains low, but organizations should consider the vulnerability high enough to warrant timely patching.