CVE-2026-64037 - Vulnerability Details

- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled

When the TLC notification disables AMSDU for a TID, the MLD driver sets
max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in
iwl_mld_tx_tso_segment() checks for zero but not for this sentinel,
allowing it to reach the num_subframes calculation:

num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)
= (1 + 2) / (1534 + 2) = 0

This zero propagates to iwl_tx_tso_segment() which sets:

gso_size = num_subframes * mss = 0

Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny
segments from a single GSO skb. This floods the TX ring with ~1024
micro-frames (the rest are purged), creating a massive burst of TX
completion events that can lead to memory corruption and a subsequent
use-after-free in TCP's retransmit queue (refcount underflow in
tcp_shifted_skb, NULL deref in tcp_rack_detect_loss).

The MVM driver is immune because it checks mvmsta->amsdu_enabled before
reaching the num_subframes calculation. The MLD driver has no equivalent
bitmap check and relies solely on max_tid_amsdu_len, which does not
catch the sentinel value.

Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the
existing check and falling back to non-AMSDU TSO segmentation. Also add
a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth
to catch any future code paths that produce zero through a different
mechanism.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The iwlwifi MLD driver in the Linux kernel incorrectly handles a sentinel value when AMSDU is disabled, allowing the TSO segmentation logic to generate thousands of zero-size segments that overflow the TX ring and corrupt kernel memory. This memory corruption can lead to a use‑after‑free in TCP’s retransmit queue, creating a refcount underflow and null dereference that could allow an attacker to execute arbitrary code. The flaw is a classic null‑pointer dereference issue (CWE‑476).

Affected Systems

All Linux kernel releases that include the buggy iwlwifi MLD driver before the commit adding the sentinel check are vulnerable; any kernel version prior to the fix is impacted. The affected product is the Linux kernel, specifically the iwlwifi MLD driver component.

Risk and Exploitability

The CVSS score is 9.8 and the EPSS score is less than 1 %, indicating a high severity but low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through crafted wireless traffic that disables AMSDU, forcing the MLD driver to process malicious frames. Exploitation would require the target device to receive the traffic (either Wi‑Fi network).

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d1e879ec600f9b3bdd253167533959facfefb17b`	affected	< 9e360e610a73f62432e986775023d5382773f045
`d1e879ec600f9b3bdd253167533959facfefb17b`	affected	< cbe1c8245e4469d1aa6e12e5d913611376d23788
`d1e879ec600f9b3bdd253167533959facfefb17b`	affected	< 92cee08dc4f00e77fd1317e4343c5d458b0abab7

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d1e879ec600f9b3bdd253167533959facfefb17b,9e360e610a73f62432e986775023d5382773f045)`	affected	code_commit	—
`[d1e879ec600f9b3bdd253167533959facfefb17b,cbe1c8245e4469d1aa6e12e5d913611376d23788)`	affected	code_commit	—
`[d1e879ec600f9b3bdd253167533959facfefb17b,92cee08dc4f00e77fd1317e4343c5d458b0abab7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.15`	affected	generic	—
`[0,6.15)`	unaffected	generic	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel version that includes the iwlwifi fix (commit implementing the sentinel check).
If an immediate kernel upgrade is not possible, disable AMSDU transmission module parameter or network configuration, thereby preventing the vulnerable code path from being exercised.
As a last resort, unload or disable the iwlwifi module if Wi‑Fi functionality is not required, or prevent the wireless interface from coming up at boot.
Enable kernel hardening options such as CONFIG_PAGE_TABLE_ISOLATION and CONFIG_X86_64_LAZY_GUARD to reduce the damage potential of any remaining memory corruption vulnerabilities.

Generated by OpenCVE AI on July 30, 2026 at 20:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0043.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7
https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045
https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788
https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-64037-3ce2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64037
https://www.cve.org/CVERecord?id=CVE-2026-64037

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-64037-3ce2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64037 https://www.cve.org/CVERecord?id=CVE-2026-64037
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, allowing it to reach the num_subframes calculation: num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) = (1 + 2) / (1534 + 2) = 0 This zero propagates to iwl_tx_tso_segment() which sets: gso_size = num_subframes * mss = 0 Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). The MVM driver is immune because it checks mvmsta->amsdu_enabled before reaching the num_subframes calculation. The MLD driver has no equivalent bitmap check and relies solely on max_tid_amsdu_len, which does not catch the sentinel value. Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism.
Title		wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7 https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045 https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:25.435Z

Updated: 2026-08-05T12:38:31.759Z

Reserved: 2026-07-19T07:54:57.028Z

Link: CVE-2026-64037

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64037 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T21:00:22Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object