Linux Kernel iwlwifi EUVD-2026-27735

Requires adjacent network access to target WiFi network (AV:A) - attacker must be within radio range and associated with same WiFi network as victim system. Target must be running Linux kernel with Intel 22000 series wireless chipset (AX200/AX201/AX210 families) using vulnerable iwlwifi driver version (pre-6.18.16, pre-6.19.6, or pre-7.0). Exploitation requires either: (1) attacker capability to transmit malformed WiFi management frames that induce firmware to report invalid LMAC counts, which depends on firmware's own input validation weaknesses, or (2) prior compromise of device firmware through supply chain attack or local hardware modification. No user interaction required (UI:N). No authentication to OS required (PR:N), though attacker may need WPA2/WPA3 credentials to associate with protected WiFi network (network-level auth, not OS-level). Limiting factors: attack surface restricted to WiFi-enabled systems with specific Intel chipset; firmware interaction complexity makes exploitation harder than typical network service bugs; kernel exploitation requires bypassing modern protections like KASLR, SMEP, SMAP which increases attacker sophistication requirements beyond initial memory corruption.

Real-world risk is moderate despite high CVSS 8.8 scoring. The CVSS vector AV:A (adjacent network) indicates attacker must be on same WiFi network or have local firmware modification capability - not remotely exploitable from internet. AC:L (low complexity) and PR:N (no privileges) suggest exploitation is straightforward once adjacent access obtained, but the critical constraint is the attacker must either compromise the WiFi firmware itself (difficult, requires vendor signing key bypass or hardware modification) or exploit the vulnerability through crafted over-the-air WiFi management frames that influence firmware state. EPSS 0.02% (5th percentile) reflects that this attack surface is uncommon - firmware vulnerabilities are rarely exploited at scale compared to network service flaws. No CISA KEV listing confirms no active exploitation observed. No public POC identified. SSVC framework assessment: Exploitation=none, Automatable=no (requires adjacent positioning and firmware interaction), Technical Impact=total (kernel memory corruption enables privilege escalation to root). Priority: Medium for enterprise WiFi environments and high-security contexts where adjacent network threats are realistic; lower priority for isolated systems. The primary value is defense-in-depth against firmware supply chain compromise scenarios.

Attacker positions on same WiFi network as target system with vulnerable Intel 22000 series wireless chipset (e.g., corporate guest network, coffee shop, shared apartment building WiFi). Attacker uses software-defined radio or modified WiFi firmware to transmit specially crafted 802.11 management frames that trigger firmware state changes, causing the firmware to report three LMACs during SMEM configuration updates. Vulnerable iwlwifi driver processes malformed SMEM data without bounds checking, writing attacker-controlled data to kernel memory beyond the lmac[2] array boundary, corrupting adjacent kernel structures such as function pointers or credentials. Attacker chains this memory corruption with return-oriented programming (ROP) to execute arbitrary code in kernel context, escalating to root privileges and installing persistent backdoor.