CVE-2026-93063

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The oversized iwl_sap_hdr.len is written by CSME into the DMA-mapped ME-to-host SAP notification queue and consumed in iwl_mei_handle_sap_rx_cmd after iwl_mei_rx() handles SAP_ME_MSG_CHECK_SHARED_AREA on the MEI RX callback (mei_cldev_register_rx_cb). 802.11 frames use the separate data queue and iwl_mei_handle_sap_data(), so this is a local coprocessor path.

AC:LAttack complexity, low

CSME fully controls the little-endian hdr->len used as the memcpy length in iwl_mei_read_from_q(). The valid_rx_sz check only keeps the copy inside the 62720-byte SAP_M2H_NOTIF_Q_SZ, which still far exceeds the alloc_page() destination, so an oversized len overflows that page deterministically with no race.

PR:NPrivileges required, none

iwl_mei_enable() registers iwl_mei_rx as the MEI RX callback at probe with no Linux credential or capability check. Compromised CSME firmware can emit SAP_ME_MSG_CHECK_SHARED_AREA and a crafted notification without any host account.

UI:NUser interaction, none

iwl_mei_probe() maps shared memory, enables the MEI client, and sends SAP_ME_MSG_START; CSME can then post CHECK_SHARED_AREA and the oversized notification on its own. No victim open, mount, or click is required.

S:UScope, unchanged

The overflow writes past a host-kernel alloc_page() buffer into adjacent pages in the same kernel that contains iwlmei. The mei_cldev_dma_map() window is the intended CSME shared area, not an IOMMU bypass, VM escape, or other changed-scope boundary.

C:HConfidentiality impact, high

iwl_mei_read_from_q() copies tens of KB of CSME-chosen payload past the 4 KiB page into neighboring page-allocator contents. That kernel-memory corruption is leverageable for high-confidentiality disclosure of adjacent objects.

I:HIntegrity impact, high

The same memcpy is an out-of-bounds write of CSME-controlled bytes past the alloc_page() buffer into adjacent kernel pages, a primitive that can corrupt neighboring objects and hijack kernel control flow.

A:HAvailability impact, high

Writing tens of KB past a single alloc_page() into unmapped or neighboring pages produces a kernel oops or panic in iwl_mei_handle_sap_rx_cmd, so availability impact is high.