CVE-2026-97432

A flaw was found in the Linux kernel's Intel Wi-Fi (iwlwifi) driver, which can lead to a Denial of Service (DoS). Improper state management during Peer-to-Peer (P2P) device binding operations allows an inactive interface to remain bound after its underlying hardware context is removed. A local user performing wireless interface configuration or peer-to-peer operations can trigger this condition, causing the wireless firmware to crash.

A flaw was found in the Linux kernel's Intel Wi-Fi (iwlwifi) driver. Improper state management of Peer-to-Peer (P2P) device binding operations can leave an inactive P2P-Device interface in a binding after its underlying PHY context has been removed. A local user able to perform wireless interface configuration or peer-to-peer operations (for example a remain-on-channel followed by interface binding updates and removal) can trigger this condition, causing the wireless firmware to crash and resulting in a denial of service of the Wi-Fi subsystem. This issue has been rated as having Moderate impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with privileges, and only availability of the wireless subsystem is affected; there is no impact to confidentiality or integrity.

This issue affects Red Hat Enterprise Linux 9 (from rhel-9.4 onward) and Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform versions shipping the RHEL 9 based CoreOS kernel (4.16 and later). Red Hat Enterprise Linux 6, 7, and 8, and earlier Red Hat Enterprise Linux 9 streams such as rhel-9.2.0.z, are not affected because the vulnerable code is not present in those kernels.

The fix for the affected streams is currently deferred and is expected to be delivered in a future scheduled kernel update. Until then, the residual risk is limited to a local denial of service of the wireless subsystem on systems where a privileged local user can perform the triggering P2P and interface configuration sequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.