CVE-2026-64176: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.)
While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2, to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the code in iwlmvmmac80211idxtohwrate() to no longer have different values for different APIs. This was correct.
However, I later reverted this part of the change, because it was reported that I had broken beacon rates, causing a FW assert/crash. This caused TXCMD rates to be set incorrectly, potentially causing a warning when reported back from the device as having been used.
Fix this (hopefully correctly now) by handling beacon rates in the TXCMD that's embedded in the beacon template command separately. Restore iwlmvmmac80211idxtohwrate() to return only the rate index, not PLCP value, fixing the real TXCMD.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64176?
The severity of CVE-2026-64176 is rated at risk level 27.
How do I fix CVE-2026-64176?
To fix CVE-2026-64176, update the Linux kernel to the patched version that resolves driver-set TX rates for old devices.
What devices are affected by CVE-2026-64176?
CVE-2026-64176 affects older devices such as the 7265D that still use version 1 format for encoding rates.
What type of vulnerability is CVE-2026-64176?
CVE-2026-64176 is a vulnerability related to the WiFi driver in the Linux kernel.
When was CVE-2026-64176 published?
CVE-2026-64176 was published on July 19, 2026.