Look up another CVE · open CVE-2026-64175 in the interactive tracker
CVE-2026-64175
wifi: iwlwifi: mld: stop TX during firmware restart
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64175 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/wireless/intel/iwlwifi/mld/tx.c
- What this is
- INTEL WIRELESS WIFI LINK (iwlwifi)MAINTAINERS section matched on drivers/net/wireless/intel/iwlwifi/ · linux-wireless@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_IWLMEI|CONFIG_IWLMLD|CONFIG_IWLWIFI|CONFIG_WLAN|CONFIG_WLAN_VENDOR_INTEL' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidn
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_IWLMEI, CONFIG_IWLMLD, CONFIG_IWLWIFI, CONFIG_WLAN, CONFIG_WLAN_VENDOR_INTEL
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.35%, higher than 27.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.15 | 6.18.34 | dc31c6947652 |
| 6.15 | 7.0.11 | 13f1786395db |
| 6.15 | 7.1 | 2becb38a3e21 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is reached when outbound traffic drives mac80211 TX during firmware restart; a remote attacker can sustain that by sending high-volume packets to the victim over the network, causing responses and continued TX without local access.
- AC:LAttack complexity, low
- An attacker can reliably generate sustained high-throughput traffic that both stresses the iwlwifi MLD firmware and keeps TX queues active during the restart window; on affected Intel Wi-Fi 7 hardware firmware crashes occur frequently under such load.
- PR:NPrivileges required, none
- Exploitation requires only the ability to send network traffic to the victim; no local account, kernel capabilities, or authentication is needed to keep the TX dequeue loop running during firmware restart.
- UI:NUser interaction, none
- No victim interaction beyond normal network connectivity is required; the attacker can trigger the condition by flooding or sustaining traffic to the target.
- S:UScope, unchanged
- Impact is confined to kernel/driver resource exhaustion on the affected host and does not cross a security boundary such as VM escape or sandbox breakout.
- C:NConfidentiality impact, none
- The flaw causes skb allocate/free churn and CPU waste but does not corrupt memory, leak kernel data, or provide an out-of-bounds or use-after-free read primitive.
- I:NIntegrity impact, none
- Failed transmits are dropped and freed cleanly; there is no arbitrary write, code execution, or integrity compromise beyond dropped packets during the restart window.
- A:HAvailability impact, high
- The missing guard creates a tight dequeue-send-fail-free loop under high throughput during firmware restart, wasting CPU and causing memory pressure from slab fragmentation that can render the system effectively unavailable.