CVE-2026-43172 Overview
CVE-2026-43172 is a Linux kernel vulnerability in the iwlwifi Intel wireless driver. The flaw affects SMEM (shared memory) parsing logic for the Intel Wireless 22000 series. If firmware reports three Logical MACs (LMACs) — a configuration that does not exist in real hardware — the driver accesses fwrt->smem_cfg.lmac[2], which exceeds the array bounds. The fix rejects such configurations and replaces WARN_ON with IWL_FW_CHECK for safer handling.
Critical Impact
Malformed or malicious firmware reporting unexpected LMAC counts can trigger an out-of-bounds array read in the Linux kernel iwlwifi driver, potentially leading to memory corruption or kernel instability.
Affected Products
- Linux kernel versions containing the iwlwifi driver with 22000 series support
- Systems using Intel Wireless 22000 series wireless adapters
- Distributions shipping affected upstream kernel revisions
Discovery Timeline
- 2026-05-06 - CVE CVE-2026-43172 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43172
Vulnerability Analysis
The vulnerability resides in the Intel iwlwifi driver SMEM configuration parsing routine. The driver maintains a fixed-size array fwrt->smem_cfg.lmac[] sized for the LMAC count supported by real Intel 22000 series hardware. When firmware reports an invalid count of three LMACs, the driver indexes lmac[2], reading past the array boundary.
The original code used WARN_ON to flag the unexpected condition. WARN_ON produces a stack trace but does not stop execution, so out-of-bounds access proceeds anyway. The patch replaces this pattern with IWL_FW_CHECK, which rejects the invalid firmware report and prevents the unsafe array dereference.
This class of issue falls under out-of-bounds read [CWE-125]. Kernel-space out-of-bounds reads can disclose adjacent memory contents, corrupt driver state, or cause stability issues depending on memory layout.
Root Cause
The driver trusted firmware-reported LMAC counts without validating them against the static array dimension before performing array indexing. No upper-bound check guarded the fwrt->smem_cfg.lmac[2] access path.
Attack Vector
Exploitation requires a firmware image that reports three LMACs to the driver during initialization. Attack scenarios include malicious or tampered firmware loaded onto the wireless device, supply chain compromise of firmware blobs, or fault-injection scenarios where the firmware-driver interface produces unexpected values.
The vulnerability manifests during driver firmware parsing. Refer to the upstream commits for technical implementation details: kernel commit 1d49a427, kernel commit 2b4b1510, and kernel commit 58192b9c.
Detection Methods for CVE-2026-43172
Indicators of Compromise
- Kernel ring buffer entries from iwlwifi containing WARN_ON traces referencing smem_cfg parsing
- Unexpected wireless driver crashes or iwlwifi initialization failures on systems using Intel 22000 series adapters
- Loading of unsigned or unofficial firmware files matching iwlwifi-*.ucode patterns
Detection Strategies
- Monitor dmesg and journalctl -k output for iwlwifi warnings, oops, or panics during boot and module reload
- Audit the firmware files in /lib/firmware/ for integrity using vendor-provided checksums
- Track kernel module load events and version strings to identify systems running unpatched iwlwifi builds
Monitoring Recommendations
- Centralize kernel logs and alert on stack traces originating from iwl_init_sband_channels or iwlwifi SMEM routines
- Maintain inventory of kernel versions across Linux endpoints and flag versions predating the upstream fix commits
- Correlate wireless driver anomalies with firmware modification events on the same host
How to Mitigate CVE-2026-43172
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable git commits or update to a distribution kernel package containing the fix
- Verify the integrity of iwlwifi firmware files in /lib/firmware/ against vendor-published hashes
- Restrict the ability of non-root users and unprivileged processes to reload kernel modules or replace firmware blobs
Patch Information
The fix is committed upstream across three stable kernel branches: 1d49a42717bdc8de77eabeb5b7d3e88d141ffea9, 2b4b1510aaaf5b9fb57327ecffc20c055f61f205, and 58192b9ce09b0f0f86e2036683bd542130b91a98. The patch rejects firmware reports of three LMACs and replaces WARN_ON with IWL_FW_CHECK to ensure the unsafe array access does not execute. Apply the kernel update from your distribution maintainer.
Workarounds
- Disable the iwlwifi module on systems that do not require Intel 22000 series wireless connectivity using modprobe -r iwlwifi and blacklisting in /etc/modprobe.d/
- Enforce signed firmware loading via kernel lockdown mode where supported
- Use only firmware images shipped by the distribution or directly from Intel's linux-firmware repository
# Blacklist the iwlwifi module until the kernel is patched
echo "blacklist iwlwifi" | sudo tee /etc/modprobe.d/blacklist-iwlwifi.conf
sudo modprobe -r iwlwifi
# Verify installed kernel version after update
uname -r
# Check firmware file integrity
sha256sum /lib/firmware/iwlwifi-*.ucode
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
