CVE-2026-64175: wifi: iwlwifi: mld: stop TX during firmware restart
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: stop TX during firmware restart
When iwlwifi firmware crashes (e.g., NMIINTERRUPTUNKNOWN on Intel BE201/Wi-Fi 7), iwlmldnicerror() sets mld->fwstatus.inhwrestart to true. However, iwlmldtxfromtxq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport layer.
Since the firmware is dead, iwltranstx() returns -EIO for each frame, which then gets freed immediately. Under high-throughput conditions (e.g., Tailscale UDP traffic or active SSH sessions), this creates a tight dequeue-send-fail-free loop that wastes CPU cycles and generates rapid skb allocation churn, leading to memory pressure from slab fragmentation.
The RX path already has this guard (iwlmldrxmpdu checks inhwrestart at rx.c:1906), and so does the TXQ allocation worker (iwlmldaddtxqswk at tx.c:156). Add the same guard to iwlmldtxfromtxq() to stop all TX during firmware restart.
Frames left in mac80211's TXQs are naturally drained after restart completes, when queue reallocation triggers iwlmldtxfromtxq() via iwlmldaddtxqlist(), or when new upper-layer traffic invokes waketxqueue.
Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on kernel 6.19.5 where the firmware crashes approximately every 10-15 minutes under Tailscale traffic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel iwlwifi (iwlwifi MLD)to a version that resolves this vulnerability.Fixed in 6.19.5 - Configuration
Add a check so iwl_mld_tx_from_txq() stops dequeuing/sending frames from mac80211 TXQs when mld->fw_status.in_hw_restart is set, mirroring the existing TXQ allocation worker/RX-path guard behavior (e.g., in the kernel change described as “wifi: iwlwifi: mld: stop TX during firmware restart”).
iwlwifi (iwl_mld_tx_from_txq / firmware restart handling) in_hw_restart guard = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64175?
CVE-2026-64175 has a risk score of 24, indicating a significant vulnerability in the Linux kernel.
How do I fix CVE-2026-64175?
To fix CVE-2026-64175, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2026-64175?
CVE-2026-64175 affects systems running the Linux kernel with iwlwifi drivers, particularly those using Intel BE201/Wi-Fi 7 hardware.
What symptoms indicate CVE-2026-64175 is present?
Symptoms of CVE-2026-64175 may include intermittent wireless connectivity issues or crashes associated with firmware restarts.
Is CVE-2026-64175 related to wireless communication?
Yes, CVE-2026-64175 is related to the iwlwifi driver, which is used for wireless communication on certain Intel devices.