Security readout for executives and security teams
Plain-English summary
A Linux Wi-Fi driver handler may read beyond the available match data when processing a notification. This could expose unintended data or disrupt a system. The supplied CVSS score is 8.1, but the sources do not document a working exploit or observed attacks.
Executive priority
Prioritize remediation for exposed laptops and other Wi-Fi-enabled Linux endpoints, especially those operating in untrusted locations. The high score warrants prompt action, but there is no sourced evidence of active exploitation. Resolve kernel-version ambiguity through vendor advisories and backport verification before declaring systems vulnerable or fixed.
Technical view
The iwlwifi MVM network-discovery match handler trusts a dynamic matches array without fully confirming packet length before memcpy. The kernel fix strengthens length validation so the source buffer is large enough. CVSS 3.1 describes adjacent access, low complexity, no privileges, no user interaction, and potentially high confidentiality and availability impact.
Likely exposure
Exposure is limited to Linux systems using the affected iwlwifi MVM code. The supplied version data identifies affected releases from 6.1 through 7.0 but is ambiguous and includes unusual entries. Distribution kernels may contain backports, so determine status from kernel provenance and the referenced stable commits rather than version strings alone.
Exploitation context
The CVSS vector requires adjacent network access. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public exploit code, or demonstrated real-world impact. Treat the confidentiality and availability consequences as potential until further technical evidence emerges.
Researcher notes
The source describes a potential out-of-bounds read and unwanted destination data, while CVSS assigns high confidentiality and availability impact. Concrete crash, disclosure behavior, reachable notification conditions, and affected hardware scope are not established in the bundle. The duplicate commit identifier and unusual version entries reduce confidence in version-only assessments.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check distribution advisories because kernel fixes may be backported without changing the apparent release family.
- Prioritize systems that load the affected iwlwifi driver and operate near untrusted wireless networks.
- If updates are unavailable, request vendor-specific mitigation guidance; none is documented in the supplied sources.
Validation and detection
- Inventory kernel builds and identify systems loading the iwlwifi driver.
- Compare each kernel's source or package changelog with the six referenced stable commits.
- Confirm the handler validates sufficient packet length before copying match data.
- After updating, verify systems boot normally and affected wireless functions remain operational.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31779 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f6abac936a0dfd31d6c3e49205ec0ee75a8f887fCVE reference, Linux
- https://git.kernel.org/stable/c/ffbed27ba15ef80d1c622eeedbfef03e501ae134CVE reference, Linux
- https://git.kernel.org/stable/c/e67d8c626ace80b0fa2b48c8ec0a46b508c93442CVE reference, Linux
- https://git.kernel.org/stable/c/dd90880eb5ec5442b37eb2b95688f4a63f4883e3CVE reference, Linux
- https://git.kernel.org/stable/c/ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2CVE reference, Linux
- https://git.kernel.org/stable/c/744fabc338e87b95c4d1ff7c95bc8c0f834c6d99CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.