CVE-2026-43172 wifi: iwlwifi: fix 22000 series SMEM parsing
A flaw in the iwlwifi driver allows an array overrun if firmware reports invalid LMAC counts, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43172?
CVE-2026-43172 is a high-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: fix 22000 series SMEM parsing
If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Reject such and use IWL_FW_CHECK instead of WARN_ON in this function.
Weakness: CWE-129
Which versions are affected by CVE-2026-43172?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43172?
Apply the vendor's patch.
Is CVE-2026-43172 being exploited?
There is no known exploitation of CVE-2026-43172 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-85824, BELL-CVE-2026-43172, DEBIAN-CVE-2026-43172, GHSA-g3v6-g863-2542, ROOT-OS-DEBIAN-11-CVE-2026-43172, ROOT-OS-DEBIAN-12-CVE-2026-43172 and 4 more.