CVE-2026-64037: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
When the TLC notification disables AMSDU for a TID, the MLD driver sets maxtidamsdulen to the sentinel value 1. The TSO segmentation path in iwlmldtxtsosegment() checks for zero but not for this sentinel, allowing it to reach the numsubframes calculation:
numsubframes = (maxtidamsdulen + pad) / (subflen + pad) = (1 + 2) / (1534 + 2) = 0
This zero propagates to iwltxtsosegment() which sets:
gsosize = numsubframes mss = 0
Calling skbgsosegment() with gsosize=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcpshiftedskb, NULL deref in tcprackdetectloss).
The MVM driver is immune because it checks mvmsta->amsduenabled before reaching the numsubframes calculation. The MLD driver has no equivalent bitmap check and relies solely on maxtidamsdulen, which does not catch the sentinel value.
Fix this by detecting the sentinel value (maxtidamsdulen == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARNONONCE guard after the numsubframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the iwlwifi MLD TSO segmentation path, detect the sentinel value max_tid_amsdu_len == 1 before the num_subframes calculation and fall back to non-AMSDU TSO segmentation; retain a WARN_ON_ONCE guard after the num_subframes division as defense in depth.
Event History
Frequently Asked Questions
Which Linux Wi-Fi driver path is affected?
The affected path is the iwlwifi MLD driver when a TLC notification disables AMSDU for a traffic identifier (TID). The MVM driver is described as immune because it checks whether AMSDU is enabled before performing the subframe calculation.
What access does exploitation require?
The supplied severity vector rates the issue as network-reachable, low complexity, with no privileges or user interaction required. The vulnerable condition still depends on AMSDU having been disabled for a TID in the MLD driver.
What behavior may indicate that the vulnerable path was triggered?
A single GSO packet can be split into more than 32,000 tiny segments, flooding the transmit ring with roughly 1,024 micro-frames before the remainder are purged. This can cause a large burst of transmit-completion events followed by memory corruption and use-after-free failures in TCP retransmission handling.