CVE-2026-31779

A flaw was found in the Linux kernel's iwlwifi component. This vulnerability involves a potential out-of-bounds read within the iwl_mvm_nd_match_info_handler() function. The memcpy function, used in this handler, does not adequately validate the size of an incoming packet, which could allow an attacker to read unintended data from memory. This could potentially lead to information disclosure.

This vulnerability is rated as having Moderate impact because exploitation requires the host system to have physical Intel wireless hardware active and configured, which is absent in standard enterprise server deployments. An attacker within wireless network range would need to transmit specially crafted network packets to induce an out-of-bounds memory read, potentially leading to a denial of service or information leakage. Consequently, the blast radius is restricted to physical endpoints operating affected Wi-Fi adapters, leaving virtualized environments and headless servers unaffected by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.