CVE-2026-64212 - Vulnerability Details

- wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it

In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the
function so we have it after we freed the link.

But the link pointer can be NULL, and is not checked when the fw_id is
stored.

Fix it by simply freeing the link at the end of the function.

fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()")

Published: 2026-07-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This CVE represents a null‑pointer dereference in the iwl_mld_remove_link function of the iwlwifi driver. The function stores the link->fw_id before freeing the link object. If the link pointer is NULL, the dereference occurs, causing a use‑after‑free that leads to a kernel crash.

Affected Systems

All Linux kernel implementations that include the iwlwifi Wi‑Fi driver and have not applied the commit 0e66a39f4f0e are affected. Because the vulnerable code is part of the kernel's wireless subsystem, any device running a recent kernel that supports Intel wireless hardware may be impacted.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no remote exploitation vector is documented. Attackers would need local or privileged access to trigger the misuse of the iwlwifi driver, and the impact is limited to a denial of service rather than privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3a74aaad047353da3344aed32e9042d4f334f926
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d733ed481fd20a8e7bfe5119c4e77761ba3f87ee
`0`	affected	< 6.18.34
`0`	affected	< 7.0.11

Linux

affected

Version	Status	Constraints
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3a74aaad047353da3344aed32e9042d4f334f926)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d733ed481fd20a8e7bfe5119c4e77761ba3f87ee)`	affected	code_commit	—
`[0,6.18.34)`	affected	semver	—
`[0,7.0.11)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains commit 0e66a39f4f0e, which addresses the use‑after‑free in iwl_mld_remove_link.
Reboot the system so the patched kernel is loaded.
Until an update is available, temporarily unload or disable the iwlwifi module (for example, modprobe -r iwlwifi) to prevent potential crashes.

Generated by OpenCVE AI on August 2, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00117.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3a74aaad047353da3344aed32e9042d4f334f926
https://git.kernel.org/stable/c/b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0
https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee
https://lore.kernel.org/linux-cve-announce/2026072414-CVE-2026-64212-71ba@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64212
https://www.cve.org/CVERecord?id=CVE-2026-64212

History

Tue, 11 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

Sun, 02 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476 CWE-590

Sat, 01 Aug 2026 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072414-CVE-2026-64212-71ba@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64212 https://www.cve.org/CVERecord?id=CVE-2026-64212
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 26 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is not checked when the fw_id is stored. Fix it by simply freeing the link at the end of the function. fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()")
Title		wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3a74aaad047353da3344aed32e9042d4f334f926 https://git.kernel.org/stable/c/b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0 https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-24T15:23:02.449Z

Updated: 2026-07-24T15:23:02.449Z

Reserved: 2026-07-19T15:36:31.770Z

Link: CVE-2026-64212

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-24T16:16:48.843

Modified: 2026-08-11T17:23:05.267

Link: CVE-2026-64212

Redhat

Severity : Moderate

Publid Date: 2026-07-24T00:00:00Z

Links: CVE-2026-64212 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T14:30:03Z

Weaknesses

CWE-476
NULL Pointer Dereference
CWE-590
Free of Memory not on the Heap

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object