The Linux kernel's iwlwifi mvm driver contained a vulnerability where the memcpy function assumed the dynamic array notif->matches was at least as large as the number of bytes to copy, potentially causing an out-of-bounds read in iwl_mvm_nd_match_info_handler(). This could result in the results->matches array containing unintended data. The fix extends validation checks to ensure sufficient packet length before copying. The vulnerability is tracked as CVE-2026-31779 with a CVSS 3.1 score of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), indicating a high impact on confidentiality and availability via an adjacent network attack vector without privileges or user interaction. Multiple Linux kernel versions prior to 6.8.0-1064.72~22.04.1 and related builds are affected. The vendor (Ubuntu) has released patched kernel versions and advises rebooting after update and recompiling third-party kernel modules due to ABI changes.

An attacker with access to the adjacent network could exploit this vulnerability to cause an out-of-bounds read in the iwlwifi driver, potentially exposing sensitive kernel memory contents (confidentiality impact). The vulnerability does not affect integrity but can cause denial of service (availability impact). No known exploits in the wild have been reported. The CVSS score of 8.1 reflects a high severity due to confidentiality and availability impacts without requiring privileges or user interaction.

A patch is available and should be applied promptly. Users should update their Linux kernel to versions equal or newer than 6.8.0-1064.72~22.04.1 or the corresponding fixed versions listed in the advisory. After updating, a system reboot is required to apply the kernel changes. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully to ensure full remediation.