{"id":"CVE-2026-64255","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers\n\nThree BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a\nstation ID without check…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers\n\nThree BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a\nstation ID without check…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","published":"2026-07-24","updated":"2026-07-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64255","references":[{"url":"https://git.kernel.org/stable/c/1de92789ce31e46fa7e7d8e89c90b19cdb1c103b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe7f339f63c9dc4ca546ed7ac38ba4bb3a99dcfc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64255.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64255"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506782"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64255"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64255"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072420-CVE-2026-64255-f09c@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:65334"},{"url":"https://access.redhat.com/errata/RHSA-2026:67150"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00223,"epssPercentile":0.13184,"ingestedAt":"2026-07-27T06:16:49.539Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux 9","enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"cwe":["CWE-823"],"scores":{"nvd":8.8,"vendor":7},"slug":"CVE-2026-64255","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers\n\nThree BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a\nstation ID without checking that sta_mask is non-zero. When sta_mask is\nzero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing\nan out-of-bounds access on fw_id_to_link_sta[].\n\nAdd WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call,\nconsistent with the existing check in iwl_mld_ampdu_rx_start().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:65334** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65334)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64255.json)\n- **RHSA-2026:67150** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67150)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}