CVE-2026-31779: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31779 Overview

CVE-2026-31779 is an out-of-bounds read vulnerability in the Linux kernel's Intel wireless driver (iwlwifi). The flaw resides in the iwl_mvm_nd_match_info_handler() function within the MVM (multi-virtual MAC) opmode. A memcpy call assumes the dynamic array notif->matches is at least as large as the number of bytes to copy, without sufficient packet length validation. As a result, results->matches may contain unwanted memory contents from adjacent kernel structures. The issue was found by the Linux Verification Center (linuxtesting.org) using SVACE static analysis. The fix extends an existing validation check to ensure the firmware notification packet contains enough data before the copy.

Critical Impact
An adjacent-network attacker capable of injecting malformed network detection match notifications can trigger an out-of-bounds read, leaking kernel memory or causing system instability.

Affected Products

Linux kernel builds containing the iwlwifi MVM driver prior to the patch commits referenced in stable trees
Systems using Intel Wi-Fi adapters that load the iwlmvm module
Distributions tracking mainline and stable Linux kernel branches

Discovery Timeline

2026-05-01 - CVE-2026-31779 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-31779

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Linux kernel's iwlwifi MVM driver. The function iwl_mvm_nd_match_info_handler() processes Net Detect (ND) match information notifications received from Intel Wi-Fi firmware. These notifications carry a variable-length array matches describing networks matched during low-power scanning while the device is suspended.

The handler invokes memcpy to copy entries from notif->matches into the user-visible results->matches buffer. The original code did not fully validate that the inbound notification packet contained enough bytes to back the declared number of matches. When the firmware-supplied length is shorter than the structure expects, the memcpy reads past the end of the allocated notification buffer.

Root Cause

The root cause is insufficient packet length validation before a trailing flexible array copy. The driver trusted the count field associated with notif->matches without confirming the actual packet length covered the corresponding bytes. The patch extends one of the existing length checks to require sufficient packet length before the copy occurs, eliminating the boundary mismatch.

Attack Vector

The attack vector is adjacent network. Exploitation requires the ability to influence Wi-Fi firmware notifications reaching the host driver, either through a compromised or crafted radio environment that can manipulate Net Detect scan results. A successful read can disclose contents of adjacent kernel memory, undermining confidentiality, and may destabilize the kernel, affecting availability. The flaw does not directly grant code execution or integrity impact according to the published CVSS vector.

No verified proof-of-concept code is publicly available. Refer to the stable kernel commit for the exact validation change.

Detection Methods for CVE-2026-31779

Indicators of Compromise

Unexpected kernel log messages from the iwlwifi or iwlmvm modules referencing match info or Net Detect notifications
Kernel oops, warning, or KASAN reports citing iwl_mvm_nd_match_info_handler in the call stack
Anomalous wake events or scan results following resume on systems using Intel Wi-Fi adapters

Detection Strategies

Inventory hosts running vulnerable kernel versions with the iwlmvm module loaded using modinfo iwlmvm and uname -r
Enable KASAN on test builds to surface out-of-bounds reads in the iwlwifi driver during fuzzing or wake-on-WLAN testing
Correlate dmesg output around suspend/resume cycles with endpoint telemetry to flag kernel anomalies tied to Wi-Fi events

Monitoring Recommendations

Forward kernel logs to a centralized data lake and alert on stack traces referencing iwl_mvm_nd_match_info_handler or related MVM symbols
Track patch state across the Linux fleet so unpatched kernels using Intel Wi-Fi are prioritized for remediation
Monitor for unexplained crashes on mobile and laptop endpoints that frequently transition through wake-on-WLAN states

How to Mitigate CVE-2026-31779

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that incorporates the upstream fix for iwl_mvm_nd_match_info_handler()
Reboot affected systems after kernel package upgrades to load the patched iwlmvm module
Prioritize laptops and mobile endpoints using Intel Wi-Fi where wake-on-WLAN and Net Detect are enabled

Patch Information

The vulnerability is resolved across multiple stable branches. Reference the upstream commits: 744fabc3, ca0e9491, dd90880e, e67d8c62, f6abac93, and ffbed27b. Update to the kernel version from your distribution that includes these commits.

Workarounds

Disable Net Detect and wake-on-WLAN features in firmware or driver configuration where operationally acceptable until patches are deployed
Unload the iwlmvm module on systems that do not require Intel Wi-Fi connectivity using modprobe -r iwlmvm
Restrict device operation to trusted radio environments to reduce exposure to adjacent-network attackers

bash

# Verify running kernel and iwlwifi module status, then update
uname -r
modinfo iwlmvm | grep -E '^(filename|version):'

# Debian/Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# RHEL/Fedora
sudo dnf update kernel kernel-core kernel-modules

# Reboot to activate the patched kernel
sudo systemctl reboot