{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64175","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.039Z","datePublished":"2026-07-19T15:41:00.157Z","dateUpdated":"2026-08-05T12:39:53.411Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:39:53.411Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: stop TX during firmware restart\n\nWhen iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel\nBE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart\nto true. However, iwl_mld_tx_from_txq() does not check this flag before\ndequeuing frames from mac80211 and pushing them to the transport layer.\n\nSince the firmware is dead, iwl_trans_tx() returns -EIO for each frame,\nwhich then gets freed immediately. Under high-throughput conditions\n(e.g., Tailscale UDP traffic or active SSH sessions), this creates a\ntight dequeue-send-fail-free loop that wastes CPU cycles and generates\nrapid skb allocation churn, leading to memory pressure from slab\nfragmentation.\n\nThe RX path already has this guard (iwl_mld_rx_mpdu checks\nin_hw_restart at rx.c:1906), and so does the TXQ allocation worker\n(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to\niwl_mld_tx_from_txq() to stop all TX during firmware restart.\n\nFrames left in mac80211's TXQs are naturally drained after restart\ncompletes, when queue reallocation triggers iwl_mld_tx_from_txq()\nvia iwl_mld_add_txq_list(), or when new upper-layer traffic invokes\nwake_tx_queue.\n\nTested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on\nkernel 6.19.5 where the firmware crashes approximately every 10-15\nminutes under Tailscale traffic."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when outbound traffic drives mac80211 TX during firmware restart; a remote attacker can sustain that by sending high-volume packets to the victim over the network, causing responses and continued TX without local access.\nAC:L - An attacker can reliably generate sustained high-throughput traffic that both stresses the iwlwifi MLD firmware and keeps TX queues active during the restart window; on affected Intel Wi-Fi 7 hardware firmware crashes occur frequently under such load.\nPR:N - Exploitation requires only the ability to send network traffic to the victim; no local account, kernel capabilities, or authentication is needed to keep the TX dequeue loop running during firmware restart.\nUI:N - No victim interaction beyond normal network connectivity is required; the attacker can trigger the condition by flooding or sustaining traffic to the target.\nS:U - Impact is confined to kernel/driver resource exhaustion on the affected host and does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The flaw causes skb allocate/free churn and CPU waste but does not corrupt memory, leak kernel data, or provide an out-of-bounds or use-after-free read primitive.\nI:N - Failed transmits are dropped and freed cleanly; there is no arbitrary write, code execution, or integrity compromise beyond dropped packets during the restart window.\nA:H - The missing guard creates a tight dequeue-send-fail-free loop under high throughput during firmware restart, wasting CPU and causing memory pressure from slab fragmentation that can render the system effectively unavailable."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/tx.c"],"versions":[{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"dc31c69476520bb4c2a208211a8d3c310a62c4d0","status":"affected","versionType":"git"},{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"13f1786395dbbf3df73337063c798f1266be6151","status":"affected","versionType":"git"},{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"2becb38a3e217ef2b2f42fddd7db7a25905ec291","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/tx.c"],"versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","status":"unaffected","versionType":"semver"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0"},{"url":"https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151"},{"url":"https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291"}],"title":"wifi: iwlwifi: mld: stop TX during firmware restart","x_generator":{"engine":"bippy-1.2.0"}}}}