CVE-2026-64255
Received Received - Intake

WiFi BA Session Handler Out-of-Bounds Access in Linux Kernel

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[]. Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64255
EUVD
EUVD-2026-48664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
intel iwlwifi *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's iwlwifi driver for Wi-Fi devices. It involves three Block Ack (BA) session handlers that incorrectly validate station masks before using the ffs() function. When a station mask is zero, ffs() returns 0, leading to an out-of-bounds memory access due to integer underflow. The fix adds checks to ensure the station mask is non-zero before proceeding.

Detection Guidance

This vulnerability is specific to the Linux kernel's iwlwifi driver for Intel Wi-Fi devices. Detection requires checking the kernel version and iwlwifi driver logs for related errors. Use commands like 'dmesg | grep iwlwifi' or 'journalctl -k | grep iwlwifi' to search for driver-related issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) condition by triggering an out-of-bounds memory access in the kernel. This might lead to system crashes, instability, or potential privilege escalation if exploited successfully.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue in WiFi drivers. Compliance risks would only arise if exploitation led to unauthorized data access or system compromise, which is not indicated in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate kernel update is not possible, disable the affected iwlwifi driver module temporarily. Monitor vendor advisories for Intel Wi-Fi firmware updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart