Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…
EPSS 0.3%top 72%

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware… (CVE-2026-64175)

0
High
Published: 07/19/2026 (07/19/2026, 18:31:54 UTC)
Source: GCVE Database

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer. Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation. The RX path already has this guard (iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906), and so does the TXQ allocation worker (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to iwl_mld_tx_from_txq() to stop all TX during firmware restart. Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes wake_tx_queue. Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.

CVSS v3.1

Score 7.5high

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/19/2026, 19:42:13 UTC

Technical Analysis

The Linux kernel iwlwifi driver mishandles firmware restarts by not stopping transmission queues during the restart process. When the firmware crashes (e.g., on Intel BE201 Wi-Fi 7 hardware), the driver sets a flag indicating hardware restart, but the transmit function continues dequeuing frames and attempting to send them. Since the firmware is non-responsive, transmissions fail immediately, causing a loop of dequeue-send-fail-free operations that waste CPU cycles and cause slab memory fragmentation. The fix adds a guard in the transmit function to stop all transmissions during firmware restart, aligning with existing protections in the receive path and allocation workers. This prevents resource exhaustion and stabilizes operation during firmware recovery.

Potential Impact

Under high-throughput network conditions, such as active UDP or SSH traffic, the vulnerability causes excessive CPU usage and memory pressure due to continuous failed transmission attempts and rapid memory allocation/free cycles. This can degrade system performance and stability on affected Intel Wi-Fi 7 devices running vulnerable Linux kernel versions. There is no indication of direct security compromise or remote code execution from this issue.

Mitigation Recommendations

A fix has been implemented in the Linux kernel to add a guard that stops transmission during firmware restart in the iwlwifi driver. Users should update to a Linux kernel version that includes this fix (e.g., kernel 6.19.5 or later where tested). Since this is a kernel-level fix, applying the official kernel update from the distribution or vendor is the recommended remediation. Patch status is not explicitly confirmed in the advisory; users should verify with their Linux distribution's security updates for the official fix.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
GHSA-6wqh-xprc-m65r
Osv Schema Version
1.4.0
Aliases
["CVE-2026-64175"]
Ecosystems
[]
Database Specific Severity
null
Cvss Version
3.1

Threat ID: 6a5d27a82a4a8d598912a58a

Added to database: 07/19/2026, 19:38:16 UTC

Last enriched: 07/19/2026, 19:42:13 UTC

Last updated: 09/02/2026, 22:52:13 UTC

Views: 72

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses