Linux Kernel iwlwifi EUVD-2026-28609

Exploitation requires Intel AX201 wireless adapter hardware specifically - devices with 6E-capable adapters (AX210, AX211) are NOT vulnerable as they properly handle the command. The vulnerable kernel version range (6.9 through 7.0-rc7 with commits after 0d2fc8821a7d667180ce27732697105db843a1b9) must be present. Local system access with low-level user privileges sufficient to interact with wireless configuration is required (CVSS PR:L) - this typically means any user account that can trigger NetworkManager or wpa_supplicant operations, not just root. The condition is met during regulatory domain updates when the system processes Multi-Country Code information, commonly triggered by connecting to wireless networks, changing system locale/timezone, or explicit regulatory domain configuration. This is NOT remotely exploitable (CVSS AV:L) and requires no user interaction beyond normal wireless operations (UI:N). Attack complexity is low (AC:L) as it occurs through standard driver operation paths without race conditions or complex timing requirements.

Real-world risk is LOW despite the CVSS 5.5 (Medium) base score. The CVSS vector AV:L/AC:L/PR:L/UI:N indicates local access with low privileges is required - this is NOT a remote network attack. The EPSS score of 0.02% (4th percentile) confirms minimal exploitation probability in the wild. No CISA KEV listing exists and no public exploit code has been identified. The vulnerability requires: (1) local system access, (2) low-level privileges to interact with wireless subsystem, (3) specific Intel AX201 hardware, and (4) triggering the regulatory domain update path. Impact is limited to availability (A:H) - no confidentiality or integrity breach - meaning at worst a local user crashes their own Wi-Fi adapter requiring driver reload or reboot. This is a stability bug affecting a narrow hardware subset (AX201 only, not AX210/AX211 6E models) rather than a security-critical exploit primitive. Patches available across all affected stable branches reduce urgency further. Priority should be LOW for most environments; MEDIUM only for multi-user systems with untrusted local users and AX201 adapters where wireless availability is mission-critical.

A local user with standard privileges on a Linux system running kernel 6.9-7.0-rc7 with an Intel AX201 wireless adapter triggers the regulatory domain update mechanism, either by changing system location settings, connecting to networks with different country codes, or through NetworkManager configuration changes. The iwlwifi driver sends the MCC_ALLOWED_AP_TYPE_CMD command to the AX201 firmware which does not support this 6E-specific command, causing firmware to crash. The wireless adapter becomes unresponsive, requiring driver reload or system reboot to restore connectivity, resulting in local denial of service.