In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware… (CVE-2026-64175)
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.
AI Analysis
Technical Summary
The Linux kernel iwlwifi driver mishandles firmware restarts by not stopping transmission queues during the restart process. When the firmware crashes (e.g., on Intel BE201 Wi-Fi 7 hardware), the driver sets a flag indicating hardware restart, but the transmit function continues dequeuing frames and attempting to send them. Since the firmware is non-responsive, transmissions fail immediately, causing a loop of dequeue-send-fail-free operations that waste CPU cycles and cause slab memory fragmentation. The fix adds a guard in the transmit function to stop all transmissions during firmware restart, aligning with existing protections in the receive path and allocation workers. This prevents resource exhaustion and stabilizes operation during firmware recovery.
Potential Impact
Under high-throughput network conditions, such as active UDP or SSH traffic, the vulnerability causes excessive CPU usage and memory pressure due to continuous failed transmission attempts and rapid memory allocation/free cycles. This can degrade system performance and stability on affected Intel Wi-Fi 7 devices running vulnerable Linux kernel versions. There is no indication of direct security compromise or remote code execution from this issue.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add a guard that stops transmission during firmware restart in the iwlwifi driver. Users should update to a Linux kernel version that includes this fix (e.g., kernel 6.19.5 or later where tested). Since this is a kernel-level fix, applying the official kernel update from the distribution or vendor is the recommended remediation. Patch status is not explicitly confirmed in the advisory; users should verify with their Linux distribution's security updates for the official fix.
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware… (CVE-2026-64175)
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.
CVSS v3.1
Score 7.5high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel iwlwifi driver mishandles firmware restarts by not stopping transmission queues during the restart process. When the firmware crashes (e.g., on Intel BE201 Wi-Fi 7 hardware), the driver sets a flag indicating hardware restart, but the transmit function continues dequeuing frames and attempting to send them. Since the firmware is non-responsive, transmissions fail immediately, causing a loop of dequeue-send-fail-free operations that waste CPU cycles and cause slab memory fragmentation. The fix adds a guard in the transmit function to stop all transmissions during firmware restart, aligning with existing protections in the receive path and allocation workers. This prevents resource exhaustion and stabilizes operation during firmware recovery.
Potential Impact
Under high-throughput network conditions, such as active UDP or SSH traffic, the vulnerability causes excessive CPU usage and memory pressure due to continuous failed transmission attempts and rapid memory allocation/free cycles. This can degrade system performance and stability on affected Intel Wi-Fi 7 devices running vulnerable Linux kernel versions. There is no indication of direct security compromise or remote code execution from this issue.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add a guard that stops transmission during firmware restart in the iwlwifi driver. Users should update to a Linux kernel version that includes this fix (e.g., kernel 6.19.5 or later where tested). Since this is a kernel-level fix, applying the official kernel update from the distribution or vendor is the recommended remediation. Patch status is not explicitly confirmed in the advisory; users should verify with their Linux distribution's security updates for the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6wqh-xprc-m65r
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64175"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27a82a4a8d598912a58a
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:42:13 UTC
Last updated: 09/02/2026, 22:52:13 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.