CVE-2026-93065

A flaw was found in the iwlwifi driver of the Linux kernel. An integer overflow vulnerability exists where a loop counter, declared as an 8-bit unsigned integer, can wrap around if the firmware advertises more than 255 program counter entries. This can lead to an infinite loop, causing a denial of service, or potentially reading past an allocated memory array, which could result in information disclosure.

iwlwifi uses a u8 loop counter while the firmware supplied num_pc value is u32 in iwl_fwrt_dump_error_logs(). If firmware reports more than 255 PC entries, the counter can wrap to zero and the loop may never terminate or may read beyond the allocated pc_data array. For the CVSS the PR:N is used only for the paranoid adjacent Wi-Fi interpretation where an attacker may trigger firmware error handling through wireless reachability without local shell access. The issue is not Internet reachable in the normal sense and depends on Intel Wi-Fi hardware, driver state, and firmware error log contents. Impact is at least denial of service through an infinite loop or CPU lockup. Worst case impact may include limited confidentiality exposure if out of bounds pc_data reads are printed into kernel logs, but the patch does not indicate an arbitrary write or a direct privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.