---
id: CVE-2026-64255
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

  Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a
  station ID without check…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

  Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a
  station ID without check…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-07-24'
updated: '2026-07-27'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64255'
references:
  - url: 'https://git.kernel.org/stable/c/1de92789ce31e46fa7e7d8e89c90b19cdb1c103b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f056fc2b927448d37eca6b6cacc3d1b0f67b20d2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fe7f339f63c9dc4ca546ed7ac38ba4bb3a99dcfc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64255.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64255'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2506782'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64255'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64255'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072420-CVE-2026-64255-f09c@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:65334'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67150'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00223
epssPercentile: 0.13199
ingestedAt: '2026-07-27T06:16:49.539Z'
vendor: Red Hat
product: Red Hat Enterprise Linux BaseOS (v. 10)
affected:
  - enterprise_linux 9
  - enterprise_linux_appstream_v_10
  - enterprise_linux_baseos_v_10
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_v_10
patched:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_baseos_v_10
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_v_10
cwe:
  - CWE-823
scores:
  nvd: 8.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a
station ID without checking that sta_mask is non-zero. When sta_mask is
zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing
an out-of-bounds access on fw_id_to_link_sta[].

Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call,
consistent with the existing check in iwl_mld_ampdu_rx_start().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:65334** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65334)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64255.json)
- **RHSA-2026:67150** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67150)