CVE-2023-54029

A NULL pointer dereference vulnerability was found in the Intel iwlwifi wireless driver in the Linux kernel. When using Multi-Link Operation (MLO) mode, the iwl_mvm_max_amsdu_size() function incorrectly accesses vif->bss_conf.chandef.chan->band, which leads to a NULL pointer dereference because bss_conf is not used in MLO configurations.

This vulnerability affects systems with Intel wireless adapters using MLO (Wi-Fi 7) features. Exploitation causes a kernel crash but requires local access and specific MLO wireless configuration. The issue is limited to newer hardware supporting Multi-Link Operation and does not affect standard wireless configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the iwlwifi module from being loaded if Intel wireless networking with MLO is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.