CVE-2026-64175
Received Received - Intake

Wi-Fi 7 Firmware Crash Leading to CPU Exhaustion in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64175
EUVD
EUVD-2026-45860

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
intel iwlwifi From 6.19.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's iwlwifi driver for Intel Wi-Fi 7 (BE201) devices. When the firmware crashes, the driver fails to stop transmitting data, causing a loop where frames are repeatedly sent, fail, and freed. This wastes CPU resources and creates memory pressure due to rapid memory allocation and fragmentation.

Detection Guidance

Detecting this vulnerability requires monitoring for firmware crashes in Intel iwlwifi Wi-Fi 7 devices. Check kernel logs for NMI_INTERRUPT_UNKNOWN errors or frequent firmware restarts. Commands like dmesg | grep -i iwlwifi or journalctl -k | grep -i iwlwifi may show errors. High CPU usage during network activity could also indicate the issue.

Impact Analysis

Under high network traffic, this issue can degrade system performance by consuming excessive CPU cycles and causing memory fragmentation. It may lead to slower network operations, increased latency, or even system instability during Wi-Fi usage.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. It primarily causes system instability and resource exhaustion due to firmware crashes and improper TX handling, which could indirectly affect data processing integrity or availability. No evidence suggests direct data exposure or non-compliance.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Avoid using Intel BE201 Wi-Fi 7 devices under high-throughput conditions like Tailscale or SSH until the fix is applied. Monitor system logs for firmware crashes as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64175. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart