CVE-2026-31779: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31779 is an out-of-bounds read vulnerability in the Linux kernel's iwlwifi MVM (Management and Verification) Wi-Fi driver, specifically in the iwl_mvm_nd_match_info_handler() function. The flaw arises because a memcpy call assumes the dynamic array notif->matches is at least as large as the number of bytes to copy, without sufficient packet length validation. Affected Linux kernel versions span 6.1.x before 6.1.168, 6.2.x–6.6.x before 6.6.134, 6.7.x–6.12.x before 6.12.81, 6.13.x–6.18.x before 6.18.22, 6.19.x before 6.19.12, and 7.0 release candidates. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool and disclosed on May 1, 2026. It carries a CVSS v3.1 base score of 8.1 (High) per Feedly threat intelligence data (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-805 (Buffer Access with Incorrect Length Value). In iwl_mvm_nd_match_info_handler(), the driver processes network detection (ND) match notification packets from the Wi-Fi firmware; the memcpy operation copies data into results->matches without first verifying that the source packet is long enough to contain the expected number of match entries. The fix extends an existing length validation check to ensure the packet is sufficiently large before the copy proceeds, preventing reads beyond the allocated buffer. No public proof-of-concept exploit code has been identified (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation could allow an attacker positioned on the same network segment to cause the results->matches buffer to contain data from adjacent kernel memory regions, resulting in disclosure of sensitive kernel memory contents (high confidentiality impact). The vulnerability also carries a high availability impact, potentially causing kernel instability or crashes. Integrity is not directly affected. The scope is limited to the local system running the vulnerable iwlwifi driver, but kernel memory disclosure could facilitate further privilege escalation or information gathering (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires an attacker to be on an adjacent network and able to craft malicious Wi-Fi firmware notification packets, raising the practical exploitation bar (GitHub Advisory, Red Hat Bugzilla).

Apply the available kernel patches for the respective stable branches: 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. Patches are available via the Linux kernel stable tree and referenced in the GitHub Advisory (GHSA-4qpj-7mpx-3h2f) and Red Hat Bugzilla (Bug #2464491). As a temporary workaround where patching is not immediately possible, disabling or blacklisting the iwlwifi kernel module on systems that do not require Intel Wi-Fi functionality can eliminate the attack surface. Organizations should incorporate these kernel updates into their regular patch management cycle and monitor for kernel security advisories from their Linux distribution vendors (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received limited public attention, consistent with its low EPSS score and absence of active exploitation. A brief mention appeared on Mastodon via @thehackerwire shortly after disclosure, and the Yocto Project security mailing list referenced it in the context of embedded Linux kernel security updates. No significant vendor statements beyond the kernel patch commits and Red Hat Bugzilla tracking entry have been identified (GitHub Advisory).