iwlwifi mvm driver EUVD-2026-86186

Requires the attacker to control the data in a BA_WINDOW_STATUS_NOTIFICATION_ID message delivered from the WiFi adapter firmware to the host - i.e., a compromised or malicious Intel adapter/firmware, not a standard over-the-air 802.11 frame. The system must be running an affected iwlwifi mvm driver (Linux < 6.12.111 / < 6.18.53) with a supported Intel WiFi device present and active. Limiting factors: the malicious sta_id must exceed the fw_id_to_mac_id[] bounds to trigger the OOB access, the trust boundary crossed is firmware-to-kernel (raising the practical bar well above the AC:L/PR:N/AV:A the NVD vector implies), and the realistic impact is a kernel crash rather than reliable code execution.

This is another entry in the coordinated iwlwifi mvm hardening batch (siblings CVE-2026-93790/93793/93796), and its NVD CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk. The vector claims adjacent-network, unauthenticated, high triple-impact - but the actual attack surface is a firmware-to-host trust boundary: BA_WINDOW_STATUS_NOTIFICATION_ID is a message the Intel adapter firmware sends to the host driver, so the malicious 5-bit sta_id must originate from compromised/malicious device firmware, not from an over-the-air 802.11 frame. That makes AV:A misleading; a realistic vector is closer to AV:L/AC:H requiring control of the adapter firmware. The impact is an out-of-bounds array index into fw_id_to_mac_id[] used for a read/pointer dereference, which is crash-dominant (DoS) with at most limited information disclosure - not the C:H/I:H/A:H the vector asserts. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code, consistent with a low-signal, non-weaponized janitorial fix. Bottom line: no public exploit identified at time of analysis; this is a defense-in-depth bounds check with low practical priority, patch it via normal stable-kernel update cadence rather than emergency response. Conflict to note: CVSS indicates adjacent network vector but the code path is a firmware notification handler implying a compromised-adapter/local prerequisite - verify trust model before treating as remotely reachable.

An attacker who has compromised the Intel WiFi adapter firmware (or supplies a malicious/tampered adapter) crafts a BA_WINDOW_STATUS_NOTIFICATION with an out-of-range 5-bit sta_id; the unpatched mvm driver indexes fw_id_to_mac_id[] with that value without bounds checking, reading/dereferencing memory outside the array. The most likely outcome is a kernel oops (denial of service) or limited memory disclosure. No public proof-of-concept exists, and exploitation requires firmware-level control rather than a passive over-the-air frame.