CVE-2026-43172 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the iwlwifi component, particularly those using the 22000 series. Linux kernel maintainers and users should review and apply patches to address the vulnerability. Linux distribution vendors should update their kernel packages to include the patches. Users of Linux-based systems should ensure their systems are configured securely and apply patches as needed.

Why it matters

This vulnerability requires medium priority attention from Linux kernel maintainers and users. The issue has been patched, and updating to a patched version or applying the provided patches will address the vulnerability.

• Verify Linux kernel versions and apply patches to prevent potential array overrun issues.
• Monitor Linux kernel updates and security advisories for potential future vulnerabilities.
• Review system configurations and ensure iwlwifi component is properly configured and secured.
• Assess exposure and prioritize remediation based on system configurations and Linux kernel versions.

Technical summary

The Linux kernel's iwlwifi component is vulnerable to an array overrun issue when parsing SMEM data for the 22000 series. This occurs when the firmware reports an excessive number of LMACs. The issue has been addressed through a series of patches applied to the Linux kernel. The vulnerability was introduced due to inadequate bounds checking in the iwlwifi component. The Linux kernel maintainers have addressed this issue through a series of commits, including 5cc021586420c5e13acc65da5bf73edd451e2c3e, b23c7cd616a6a113363be707b7b9e4bc41b18a07, 1d49a42717bdc8de77eabeb5b7d3e88d141ffea9, 2b4b1510aaaf5b9fb57327ecffc20c055f61f205, and 58192b9ce09b0f0f86e2036683bd542130b91a98.

Defensive priority

Medium priority for Linux kernel maintainers and users, as the vulnerability requires specific conditions to be exploited and has been patched.

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers to ensure the vulnerability is addressed.
• Update Linux kernel to a version that includes the patches (e.g., versions 6.6.160, 6.12.114, 6.18.16, 6.19.6, or later).
• Monitor Linux kernel updates and security advisories for potential future vulnerabilities.
• Verify Linux kernel versions and apply patches to prevent potential array overrun issues.
• Review system configurations and ensure iwlwifi component is properly configured and secured.
• Assess exposure and prioritize remediation based on system configurations and Linux kernel versions.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was introduced due to inadequate bounds checking in the iwlwifi component. The Linux kernel maintainers have addressed this issue through a series of commits, including 5cc021586420c5e13acc65da5bf73edd451e2c3e, b23c7cd616a6a113363be707b7b9e4bc41b18a07, 1d49a42717bdc8de77eabeb5b7d3e88d141ffea9, 2b4b1510aaaf5b9fb57327ecffc20c055f61f205, and 58192b9ce09b0f0f86e2036683bd542130b91a98.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.