CVE-2026-64175

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: stop TX during firmware restart

When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel

BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart

to true. However, iwl_mld_tx_from_txq() does not check this flag before

dequeuing frames from mac80211 and pushing them to the transport layer.

Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame,

which then gets freed immediately. Under high-throughput conditions

(e.g., Tailscale UDP traffic or active SSH sessions), this creates a

tight dequeue-send-fail-free loop that wastes CPU cycles and generates

rapid skb allocation churn, leading to memory pressure from slab

fragmentation.

The RX path already has this guard (iwl_mld_rx_mpdu checks

in_hw_restart at rx.c:1906), and so does the TXQ allocation worker

(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to

iwl_mld_tx_from_txq() to stop all TX during firmwar

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References