{"id":"CVE-2026-64175","title":"wifi: iwlwifi: mld: stop TX during firmware restart","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: stop TX during firmware restart\n\nWhen iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel\nBE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->f…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < dc31c69476520bb4c2a208211a8d3c310a62c4d0","Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < 13f1786395dbbf3df73337063c798f1266be6151","Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < 2becb38a3e217ef2b2f42fddd7db7a25905ec291","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:37:10.586674Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:25.314Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64175","references":[{"url":"https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0"},{"url":"https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151"},{"url":"https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291"}],"tags":["cve.org"],"epss":0.00349,"epssPercentile":0.27009,"ingestedAt":"2026-10-16T17:24:46.808Z","slug":"CVE-2026-64175","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: stop TX during firmware restart\n\nWhen iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel\nBE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart\nto true. However, iwl_mld_tx_from_txq() does not check this flag before\ndequeuing frames from mac80211 and pushing them to the transport layer.\n\nSince the firmware is dead, iwl_trans_tx() returns -EIO for each frame,\nwhich then gets freed immediately. Under high-throughput conditions\n(e.g., Tailscale UDP traffic or active SSH sessions), this creates a\ntight dequeue-send-fail-free loop that wastes CPU cycles and generates\nrapid skb allocation churn, leading to memory pressure from slab\nfragmentation.\n\nThe RX path already has this guard (iwl_mld_rx_mpdu checks\nin_hw_restart at rx.c:1906), and so does the TXQ allocation worker\n(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to\niwl_mld_tx_from_txq() to stop all TX during firmware restart.\n\nFrames left in mac80211's TXQs are naturally drained after restart\ncompletes, when queue reallocation triggers iwl_mld_tx_from_txq()\nvia iwl_mld_add_txq_list(), or when new upper-layer traffic invokes\nwake_tx_queue.\n\nTested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on\nkernel 6.19.5 where the firmware crashes approximately every 10-15\nminutes under Tailscale traffic.\n\n## Affected\n\n- `Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < dc31c69476520bb4c2a208211a8d3c310a62c4d0`\n- `Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < 13f1786395dbbf3df73337063c798f1266be6151`\n- `Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < 2becb38a3e217ef2b2f42fddd7db7a25905ec291`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}