---
id: CVE-2026-64175
title: 'wifi: iwlwifi: mld: stop TX during firmware restart'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: iwlwifi: mld: stop TX during firmware restart

  When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel
  BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->f…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d1e879ec600f9b3bdd253167533959facfefb17b <
    dc31c69476520bb4c2a208211a8d3c310a62c4d0
  - >-
    Linux >= d1e879ec600f9b3bdd253167533959facfefb17b <
    13f1786395dbbf3df73337063c798f1266be6151
  - >-
    Linux >= d1e879ec600f9b3bdd253167533959facfefb17b <
    2becb38a3e217ef2b2f42fddd7db7a25905ec291
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:37:10.586674Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:25.314Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64175'
references:
  - url: 'https://git.kernel.org/stable/c/dc31c69476520bb4c2a208211a8d3c310a62c4d0'
  - url: 'https://git.kernel.org/stable/c/13f1786395dbbf3df73337063c798f1266be6151'
  - url: 'https://git.kernel.org/stable/c/2becb38a3e217ef2b2f42fddd7db7a25905ec291'
tags:
  - cve.org
epss: 0.00349
epssPercentile: 0.26984
ingestedAt: '2026-10-16T17:24:46.808Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: stop TX during firmware restart

When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel
BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart
to true. However, iwl_mld_tx_from_txq() does not check this flag before
dequeuing frames from mac80211 and pushing them to the transport layer.

Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame,
which then gets freed immediately. Under high-throughput conditions
(e.g., Tailscale UDP traffic or active SSH sessions), this creates a
tight dequeue-send-fail-free loop that wastes CPU cycles and generates
rapid skb allocation churn, leading to memory pressure from slab
fragmentation.

The RX path already has this guard (iwl_mld_rx_mpdu checks
in_hw_restart at rx.c:1906), and so does the TXQ allocation worker
(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to
iwl_mld_tx_from_txq() to stop all TX during firmware restart.

Frames left in mac80211's TXQs are naturally drained after restart
completes, when queue reallocation triggers iwl_mld_tx_from_txq()
via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes
wake_tx_queue.

Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on
kernel 6.19.5 where the firmware crashes approximately every 10-15
minutes under Tailscale traffic.

## Affected

- `Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < dc31c69476520bb4c2a208211a8d3c310a62c4d0`
- `Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < 13f1786395dbbf3df73337063c798f1266be6151`
- `Linux >= d1e879ec600f9b3bdd253167533959facfefb17b < 2becb38a3e217ef2b2f42fddd7db7a25905ec291`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.