EUVD-2026-87058
GHSA-58mw-q3p9-j453
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
ExploitReach iwlwifi mei driver code path
-
ExecutionTrigger wrong-pointer call to cyclic buffer function
-
ImpactCrash/corrupt kernel (DoS)
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the Intel iwlwifi wireless driver to be loaded WITH the MEI/CSME (Intel Management Engine) integration component active, meaning the host must have the relevant Intel WiFi hardware and CSME support compiled/enabled - this is not present on non-Intel-WiFi systems or kernels built without CONFIG_IWLMEI. Per the CVSS vector it also requires local access with pre-existing low-level privileges (AV:L, PR:L) and no user interaction; it cannot be triggered remotely or by an unauthenticated actor. Impact is limited to availability (kernel crash/DoS) with no confidentiality or integrity consequence, which substantially constrains realistic risk. |
| Impact | This is a low-to-moderate real-world risk that should be treated as routine kernel hygiene rather than an emergency. All exploitation signals point the same direction: the provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally-triggerable availability-only impact requiring existing low-level privileges, with no confidentiality or integrity effect. EPSS corroborates this with a very low 0.16% exploitation probability (5th percentile), there is no CISA KEV listing, and no public exploit code was identified - so no public exploit identified at time of analysis. There is a notable conflict worth flagging: the input Tags label this 'Information Disclosure,' yet the CVSS vector explicitly sets C:N/I:N and only A:H, and the description (an iwlwifi/mei driver passing the wrong first argument to iwl_mei_write_cyclic_buf()) is consistent with a memory/pointer misuse that would crash or corrupt rather than disclose information - treat the 'Information Disclosure' categorization as unverified and likely incorrect. No SSVC decision data was supplied. Net: a genuine but low-priority bug, appropriate to patch on normal kernel-update cadence. |
| Exploit ScenarioDerived | A local user or a compromised low-privileged process on a Linux host running the Intel iwlwifi driver with the MEI/CSME integration active triggers the affected driver code path, where an incorrect pointer (q_head instead of the cldev) is passed to iwl_mei_write_cyclic_buf(), causing a kernel crash or denial of service. The attack is local and low-complexity but requires some existing privilege (PR:L) and the specific Intel WiFi+CSME hardware/driver to be present. No public proof-of-concept exploit was identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
The Linux kernel's Intel iwlwifi MEI (CSME) integration passes a queue-head pointer instead of the expected device structure to iwl_mei_write_cyclic_buf(), which can drive the shared cyclic buffer into an inconsistent state and crash the kernel on systems where the iwlmei component is compiled in and Intel WiFi plus CSME hardware is present. Per the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires local access with pre-existing low-level privileges and causes availability impact only, with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and EPSS is low (0.16%, 5th percentile), so this is routine kernel hygiene rather than an emergency.
RemediationAI
Vendor-released patch: upgrade to Linux kernel 6.1.188, 6.6.157, 6.12.110, 6.18.52 or 7.2.6 (or mainline 7.3-rc1) or later, which carry the corrected iwl_mei_write_cyclic_buf() call; the individual upstream fixes are published at https://git.kernel.org/stable/c/082b353c05b8eaf07e03fc1918c176cd3c216e25, https://git.kernel.org/stable/c/034445e19f12bb8771c58e2ecf1fbd6eac9b5fac, https://git.kernel.org/stable/c/f22ad9d1077c83718d9e6c84b71726287c1d1ad3, https://git.kernel.org/stable/c/905f57aefde4f4092a411c8a55856182fb1c7598, https://git.kernel.org/stable/c/6b7d5abf3e374ca3af31ceb6b9b2efc7a48afde3 and https://git.kernel.org/stable/c/ee91ae7f5815345612d8c0afd5d7efed361bcdb5, and the NVD record is at https://nvd.nist.gov/vuln/detail/CVE-2026-100078. Distribution kernels should be updated to the vendor release that backports these commits (kernel.org stable branches are the canonical source; the CPE is linux:linux). Where immediate patching is not possible, the only effective compensating control is to remove the exposure surface: prevent the iwlmei module from loading (for example modprobe.blacklist=iwlmei on the kernel command line, or not building the kernel with CONFIG_IWLMEI), which eliminates the vulnerable code path - the trade-off is that ME/CSME-assisted WiFi features such as connection sharing with the Management Engine stop working, though ordinary Intel WiFi operation continues. Since the assessed vector requires local access with low privileges (AV:L/PR:L), restricting unprivileged local users or sandboxing them reduces but does not eliminate risk, and because there is no public exploit identified and no KEV listing, remote or unauthenticated exposure is not a concern. No network- or firewall-level mitigation is applicable to this local, availability-only issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The iwlwifi 'mei' component (CONFIG_IWLMEI) is the bridge between the Intel wireless driver and the Intel Management Engine / CSME, letting the two share connection information through a ring buffer written via iwl_mei_write_cyclic_buf(). The bug is a wrong-argument defect (function called with an incorrect parameter - the caller supplies the q_head pointer instead of the cldev device object), so the routine operates on the wrong memory structure rather than the MEI client device it expects. The vulnerable call pattern was introduced by commit 652291601459, which first appeared with Linux 5.17, and the fix restores the correct first argument. Because this is a purely local driver-internal misuse, the affected CPE is linux:linux (kernel), with exposure limited to builds that actually enable IWLMEI on Intel WiFi platforms - generic, non-Intel-WiFi, or CONFIG_IWLMEI-disabled kernels are not reachable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Driver bug reachable only locally with existing low privilege (AV:L/PR:L), reliably triggered (AC:L), causing a kernel crash with availability-only impact (C:N/I:N/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: pass correct argument to function
The first argument to iwl_mei_write_cyclic_buf() should be the cldev but the q_head pointer is passed instead. Fix it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB