Linux Kernel CVE-2026-100078

Exploitation requires the Intel iwlwifi wireless driver to be loaded WITH the MEI/CSME (Intel Management Engine) integration component active, meaning the host must have the relevant Intel WiFi hardware and CSME support compiled/enabled - this is not present on non-Intel-WiFi systems or kernels built without CONFIG_IWLMEI. Per the CVSS vector it also requires local access with pre-existing low-level privileges (AV:L, PR:L) and no user interaction; it cannot be triggered remotely or by an unauthenticated actor. Impact is limited to availability (kernel crash/DoS) with no confidentiality or integrity consequence, which substantially constrains realistic risk.

This is a low-to-moderate real-world risk that should be treated as routine kernel hygiene rather than an emergency. All exploitation signals point the same direction: the provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally-triggerable availability-only impact requiring existing low-level privileges, with no confidentiality or integrity effect. EPSS corroborates this with a very low 0.16% exploitation probability (5th percentile), there is no CISA KEV listing, and no public exploit code was identified - so no public exploit identified at time of analysis. There is a notable conflict worth flagging: the input Tags label this 'Information Disclosure,' yet the CVSS vector explicitly sets C:N/I:N and only A:H, and the description (an iwlwifi/mei driver passing the wrong first argument to iwl_mei_write_cyclic_buf()) is consistent with a memory/pointer misuse that would crash or corrupt rather than disclose information - treat the 'Information Disclosure' categorization as unverified and likely incorrect. No SSVC decision data was supplied. Net: a genuine but low-priority bug, appropriate to patch on normal kernel-update cadence.

A local user or a compromised low-privileged process on a Linux host running the Intel iwlwifi driver with the MEI/CSME integration active triggers the affected driver code path, where an incorrect pointer (q_head instead of the cldev) is passed to iwl_mei_write_cyclic_buf(), causing a kernel crash or denial of service. The attack is local and low-complexity but requires some existing privilege (PR:L) and the specific Intel WiFi+CSME hardware/driver to be present. No public proof-of-concept exploit was identified.