{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-64175", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.039Z", "datePublished": "2026-07-19T15:41:00.157Z", "dateUpdated": "2026-08-05T12:39:53.411Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:39:53.411Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: stop TX during firmware restart\n\nWhen iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel\nBE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart\nto true. However, iwl_mld_tx_from_txq() does not check this flag before\ndequeuing frames from mac80211 and pushing them to the transport layer.\n\nSince the firmware is dead, iwl_trans_tx() returns -EIO for each frame,\nwhich then gets freed immediately. Under high-throughput conditions\n(e.g., Tailscale UDP traffic or active SSH sessions), this creates a\ntight dequeue-send-fail-free loop that wastes CPU cycles and generates\nrapid skb allocation churn, leading to memory pressure from slab\nfragmentation.\n\nThe RX path already has this guard (iwl_mld_rx_mpdu checks\nin_hw_restart at rx.c:1906), and so does the TXQ allocation worker\n(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to\niwl_mld_tx_from_txq() to stop all TX during firmware restart.\n\nFrames left in mac80211's TXQs are naturally drained after restart\ncompletes, when queue reallocation triggers iwl_mld_tx_from_txq()\nvia iwl_mld_add_txq_list(), or when new upper-layer traffic invokes\nwake_tx_queue.\n\nTested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on\nkernel 6.19.5 where the firmware crashes approximately every 10-15\nminutes under Tailscale traffic." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug is reached when outbound traffic drives mac80211 TX during firmware restart; a remote attacker can sustain that by sending high-volume packets to the victim over the network, causing responses and continued TX without local access.\nAC:L - An attacker can reliably generate sustained high-throughput traffic that both stresses the iwlwifi MLD firmware and keeps TX queues active during the restart window; on affected Intel Wi-Fi 7 hardware firmware crashes occur frequently under such load.\nPR:N - Exploitation requires only the ability to send network traffic to the victim; no local account, kernel capabilities, or authentication is needed to keep the TX dequeue loop running during firmware restart.\nUI:N - No victim interaction beyond normal network connectivity is required; the attacker can trigger the condition by flooding or sustaining traffic to the target.\nS:U - Impact is confined to kernel/driver resource exhaustion on the affected host and does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The flaw causes skb allocate/free churn and CPU waste but does not corrupt memory, leak kernel data, or provide an out-of-bounds or use-after-free read primitive.\nI:N - Failed transmits are dropped and freed cleanly; there is no arbitrary write, code execution, or integrity compromise beyond dropped packets during the restart window.\nA:H - The missing guard creates a tight dequeue-send-fail-free loop under high throughput during firmware restart, wasting CPU and causing memory pressure from slab fragmentation that can render the system effectively unavailable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/mld/tx.c" ], "versions": [ { "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "dc31c69476520bb4c2a208211a8d3c310a62c4d0", "status": "affected", "versionType": "git" }, { "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "13f1786395dbbf3df73337063c798f1266be6151", "status": "affected", "versionType": "git" }, { "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "2becb38a3e217ef2b2f42fddd7db7a25905ec291", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/intel/iwlwifi/mld/tx.c" ], "versions": [ { "version": "6.15", "status": "affected" }, { "version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0" }, { "url": "https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151" }, { "url": "https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291" } ], "title": "wifi: iwlwifi: mld: stop TX during firmware restart", "x_generator": { "engine": "bippy-1.2.0" } } } }