VulnerabilityPublished 19 Jul 2026

CVE-2026-64175: Linux kernel · wifi: iwlwifi: mld: stop TX during firmware restart

Source GCVE Database

Authoritative record:CVE-2026-64175· High 7.5

Not known to be exploited · CVSS 7.5 High · fixed in dc31c69476520bb4c2a208211a8d3c310a62c4d0 : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in dc31c69476520bb4c2a208211a8d3c310a62c4d0, 13f1786395dbbf3df73337063c798f1266be6151, 2becb38a3e217ef2b2f42fddd7db7a25905ec291

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-6wqh-xprc-m65r

What to do

Upgrade Linux kernel to dc31c69476520bb4c2a208211a8d3c310a62c4d0, 13f1786395dbbf3df73337063c798f1266be6151 or 2becb38a3e217ef2b2f42fddd7db7a25905ec291.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ d1e879ec600f9b3bdd253167533959facfefb17b, < dc31c69476520bb4c2a208211a8d3c310a62c4d0	Fixed in dc31c69476520bb4c2a208211a8d3c310a62c4d0
LinuxLinux	Affected ≥ d1e879ec600f9b3bdd253167533959facfefb17b, < 13f1786395dbbf3df73337063c798f1266be6151	Fixed in 13f1786395dbbf3df73337063c798f1266be6151
LinuxLinux	Affected ≥ d1e879ec600f9b3bdd253167533959facfefb17b, < 2becb38a3e217ef2b2f42fddd7db7a25905ec291	Fixed in 2becb38a3e217ef2b2f42fddd7db7a25905ec291
LinuxLinux	Affected =6.15	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to add a guard that stops transmission during firmware restart in the iwlwifi driver. Users should update to a Linux kernel version that includes this fix (e.g., kernel 6.19.5 or later where tested). Since this is a kernel-level fix, applying the official kernel update from the distribution or vendor is the recommended remediation. Patch status is not explicitly confirmed in the advisory; users should verify with their Linux distribution's security updates for the official fix.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.

Impact

Under high-throughput network conditions, such as active UDP or SSH traffic, the vulnerability causes excessive CPU usage and memory pressure due to continuous failed transmission attempts and rapid memory allocation/free cycles. This can degrade system performance and stability on affected Intel Wi-Fi 7 devices running vulnerable Linux kernel versions. There is no indication of direct security compromise or remote code execution from this issue.

Summary

The Linux kernel iwlwifi driver mishandles firmware restarts by not stopping transmission queues during the restart process. When the firmware crashes (e.g., on Intel BE201 Wi-Fi 7 hardware), the driver sets a flag indicating hardware restart, but the transmit function continues dequeuing frames and attempting to send them. Since the firmware is non-responsive, transmissions fail immediately, causing a loop of dequeue-send-fail-free operations that waste CPU cycles and cause slab memory fragmentation. The fix adds a guard in the transmit function to stop all transmissions during firmware restart, aligning with existing protections in the receive path and allocation workers. This prevents resource exhaustion and stabilizes operation during firmware recovery.

References

Community reviews

Loading reviews…