CVE-2026-64212
Received Received - Intake

Null Pointer Dereference in Linux Kernel iwlwifi MLD

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is not checked when the fw_id is stored. Fix it by simply freeing the link at the end of the function. fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()")

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64212
EUVD
EUVD-2026-48620

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
intel iwlwifi *
intel iwlwifi to 0e66a39f4f0e (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's iwlwifi wireless driver. In the function iwl_mld_remove_link, the code saves link->fw_id before checking if the link pointer is NULL. If link is NULL, dereferencing it to access fw_id could cause a crash or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's iwlwifi driver for Intel Wi-Fi devices. Detection requires checking the kernel version and iwlwifi module for the affected code path. No direct commands are provided in the context, but you can inspect kernel logs for crashes or use kernel debugging tools like ftrace or perf to monitor iwlwifi operations.

Impact Analysis

This vulnerability could cause system instability or crashes when removing wireless network links, potentially leading to denial of service. It may also allow local attackers to trigger kernel faults if they can manipulate network interfaces.

Compliance Impact

This vulnerability is a local denial of service in the Linux kernel's iwlwifi driver due to a potential use-after-free issue. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR or HIPAA compliance. However, if exploited, it could lead to system instability, potentially causing service disruptions that might indirectly affect compliance with uptime or availability requirements in these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64212. If immediate updating is not possible, avoid using Intel Wi-Fi devices (iwlwifi driver) until the patch is applied. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart