CVE-2026-64037
Received Received - Intake

Buffer Overflow in Linux Kernel iwlwifi MLD Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, allowing it to reach the num_subframes calculation: num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) = (1 + 2) / (1534 + 2) = 0 This zero propagates to iwl_tx_tso_segment() which sets: gso_size = num_subframes * mss = 0 Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). The MVM driver is immune because it checks mvmsta->amsdu_enabled before reaching the num_subframes calculation. The MLD driver has no equivalent bitmap check and relies solely on max_tid_amsdu_len, which does not catch the sentinel value. Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64037
EUVD
EUVD-2026-45610

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
intel iwlwifi *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's iwlwifi MLD driver causes a segmentation explosion when AMSDU is disabled. When AMSDU is turned off for a traffic identifier, the driver sets a sentinel value of 1 for max_tid_amsdu_len. The TSO segmentation path incorrectly processes this value, leading to a division that results in zero subframes. This zero value causes skb_gso_segment() to create over 32000 tiny segments from a single packet, flooding the TX ring and triggering memory corruption or use-after-free vulnerabilities in TCP's retransmit queue.

Detection Guidance

This vulnerability is specific to the Linux kernel's iwlwifi MLD driver and may not have direct detection commands. Monitor kernel logs for TX ring overflows or TCP retransmit queue issues. Check for excessive segmentation events with commands like 'dmesg | grep -i segmentation' or 'journalctl -k | grep -i segmentation'.

Impact Analysis

This vulnerability can cause system instability, crashes, or remote code execution if exploited. It may lead to denial-of-service conditions by overwhelming the network stack with excessive segmentation. Systems using affected Intel wireless drivers (iwlwifi) with MLD functionality are at risk, particularly when AMSDU is disabled for specific traffic.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel networking issue unrelated to data protection, privacy, or security controls typically governed by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64037. If immediate patching is not possible, disable AMSDU for affected WiFi interfaces by setting the module parameter 'amsdu_enabled=0' for iwlwifi.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart