CVE-2026-97474

A flaw was found in the Linux kernel's Intel Wi-Fi driver (iwlwifi). This vulnerability can lead to a Denial of Service (DoS) when a wireless network interface encounters a firmware error during connection reconfiguration. Because the driver fails to immediately discard pending asynchronous notifications upon an error, it subsequently processes them and accesses previously freed memory. This invalid memory access triggers a kernel panic and crashes the system.

A moderate vulnerability was found in the Linux kernel's Intel Wi-Fi driver (iwlwifi). When a Wi-Fi firmware error occurs on a machine that has both a BSS (regular Wi-Fi) connection and a NAN (Wi-Fi Aware) connection, the driver does not immediately purge pending asynchronous firmware notifications during connection reconfiguration. After the failed reconfiguration causes mac80211 to free the BSS link, the deferred notification handler dereferences the stale fw_id_to_bss_conf entry, a use-after-free of already-freed memory, which triggers a kernel panic and crashes the system, resulting in denial of service. Exploiting this flaw requires local access and a specific sequence of conditions: simultaneous BSS and NAN connections plus a firmware error and a failed recovery of the NAN connection, so the Red Hat severity is rated Moderate (CVSS 5.5, availability impact only). This differs from the upstream CVEORG score of 7.4 (Important), which assumes high confidentiality and integrity impact that the available evidence does not demonstrate; the flaw is an invalid read leading to a panic with no demonstrated information disclosure or memory-write primitive. Affected Red Hat products are the Red Hat Enterprise Linux 9 and 10 kernels and their derivatives, including OpenShift RHEL CoreOS 9 and RHIVOS kernel offerings. Red Hat Enterprise Linux 6, 7, and 8 (including their kernel-rt variants) are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.