{"id":"CVE-2026-31779","revision":"10d894635e11465e9a27e8f7e3570315","records":[{"revision":"10d894635e11465e9a27e8f7e3570315","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31779","aliases":[],"title":"wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()\n\nThe memcpy function assumes the dynamic array notif->matches is at least\nas large as the number of bytes to copy. Otherwise, results->matches may\ncontain unwanted data. To guarantee safety, extend the validation in one\nof the checks to ensure sufficient packet length.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.","state":0,"publishedAt":"2026-05-01T14:15:06.506+00:00","modifiedAt":"2026-10-19T19:06:08.628+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/intel/iwlwifi/mvm/d3.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c\",\n                            \"lessThan\": \"f6abac936a0dfd31d6c3e49205ec0ee75a8f887f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c\",\n                            \"lessThan\": \"ffbed27ba15ef80d1c622eeedbfef03e501ae134\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c\",\n                            \"lessThan\": \"e67d8c626ace80b0fa2b48c8ec0a46b508c93442\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c\",\n                            \"lessThan\": \"dd90880eb5ec5442b37eb2b95688f4a63f4883e3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c\",\n                            \"lessThan\": \"ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c\",\n                            \"lessThan\": \"744fabc338e87b95c4d1ff7c95bc8c0f834c6d99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/wireless/intel/iwlwifi/mvm/d3.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.134\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.81\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.22\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.12\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":8.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/f6abac936a0dfd31d6c3e49205ec0ee75a8f887f","https://git.kernel.org/stable/c/ffbed27ba15ef80d1c622eeedbfef03e501ae134","https://git.kernel.org/stable/c/e67d8c626ace80b0fa2b48c8ec0a46b508c93442","https://git.kernel.org/stable/c/dd90880eb5ec5442b37eb2b95688f4a63f4883e3","https://git.kernel.org/stable/c/ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2","https://git.kernel.org/stable/c/744fabc338e87b95c4d1ff7c95bc8c0f834c6d99"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31779","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31779","identifiers":["CVE-2026-31779"]},"retained":false,"historicalAffected":[]}],"coverage":[]}