CVE-2026-64037: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64037 Overview

CVE-2026-64037 is a Linux kernel vulnerability in the iwlwifi MLD (Multi-Link Device) Wi-Fi driver. The flaw exists in the TCP Segmentation Offload (TSO) path when AMSDU (Aggregate MAC Service Data Unit) is disabled for a Traffic Identifier (TID). The MLD driver fails to detect the sentinel value max_tid_amsdu_len == 1 set by TLC (Transmit Link Configuration) notifications. This causes num_subframes to compute to zero, which propagates into skb_gso_segment() and generates over 32,000 tiny segments from a single GSO skb. The resulting TX ring flood produces memory corruption and a use-after-free in TCP's retransmit queue.

Critical Impact
Attackers on the network can trigger memory corruption and a use-after-free in the kernel TCP retransmit path, enabling denial of service and potentially kernel-level code execution.

Affected Products

Linux kernel branches containing the iwlwifi MLD driver
Intel Wi-Fi hardware using the MLD driver stack (Wi-Fi 7 capable adapters)
Distributions shipping vulnerable stable kernels prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64037 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64037

Vulnerability Analysis

The vulnerability resides in iwl_mld_tx_tso_segment() within the iwlwifi MLD driver. When the TLC notification disables AMSDU for a TID, the driver stores the sentinel value 1 in max_tid_amsdu_len. The TSO segmentation path checks for zero but not for this sentinel, so execution reaches the num_subframes calculation. With max_tid_amsdu_len = 1, pad = 2, and subf_len = 1534, the integer division (1 + 2) / (1534 + 2) yields zero.

That zero flows into iwl_tx_tso_segment() which computes gso_size = num_subframes * mss = 0. Calling skb_gso_segment() with gso_size = 0 fabricates more than 32,000 micro-segments from a single GSO skb. Roughly 1,024 micro-frames flood the TX ring and the remainder are purged, generating a burst of TX completion events. The completion burst produces refcount underflow in tcp_shifted_skb and a NULL dereference in tcp_rack_detect_loss, exposing a use-after-free in TCP's retransmit queue.

Root Cause

The MVM driver validates mvmsta->amsdu_enabled before performing the num_subframes calculation. The MLD driver lacks an equivalent bitmap check and relies solely on max_tid_amsdu_len, which does not recognize the sentinel value 1. This missing input validation on a driver-internal state variable causes an arithmetic result that violates downstream assumptions in skb_gso_segment().

Attack Vector

An attacker within Wi-Fi range or on an adjacent network segment can influence TLC feedback and TID selection to cause AMSDU to be disabled on an active TID while GSO traffic flows. Sustained traffic then triggers the zero gso_size path. Because the corruption path lives in the TCP retransmit queue, exploitation can occur without authentication or user interaction on the target host. No public exploit code is available at this time.

No verified proof-of-concept code has been released. Technical details are captured in the upstream stable commits 92cee08d, 9e360e61, and cbe1c824.

Detection Methods for CVE-2026-64037

Indicators of Compromise

Kernel oops or panic messages referencing tcp_shifted_skb refcount underflow or NULL dereference in tcp_rack_detect_loss.
Unexpected bursts of TX completion interrupts on Intel Wi-Fi 7 adapters using the iwlwifi MLD driver.
Sudden throughput collapse combined with dropped or purged frames on the wireless interface.

Detection Strategies

Enable WARN_ON_ONCE guards and monitor dmesg for warnings emitted from the TSO segmentation path in iwl_mld_tx_tso_segment().
Track kernel version and driver commit hashes across the fleet to identify hosts running vulnerable iwlwifi MLD builds.
Correlate Wi-Fi driver crash telemetry with TCP retransmit queue anomalies to surface exploitation attempts.

Monitoring Recommendations

Ship kernel logs to a centralized log store and alert on iwlwifi, tcp_shifted_skb, and tcp_rack_detect_loss strings.
Baseline TSO segment counts and alert on abnormal skb fragmentation ratios per interface.
Monitor kernel crash dumps and kdump artifacts for signatures matching the affected TCP retransmit paths.

How to Mitigate CVE-2026-64037

Immediate Actions Required

Update to a Linux stable kernel that includes commits 92cee08d, 9e360e61, or cbe1c824.
Inventory hosts running Intel Wi-Fi hardware using the iwlwifi MLD driver and prioritize patching.
Restrict untrusted access to wireless network segments while patches are staged.

Patch Information

The upstream fix detects the sentinel value max_tid_amsdu_len == 1 at the existing zero check and falls back to non-AMSDU TSO segmentation. A WARN_ON_ONCE guard is added after the num_subframes division as defense-in-depth. Refer to the Kernel Git Commit 92cee08d, Kernel Git Commit 9e360e61, and Kernel Git Commit cbe1c824.

Workarounds

Disable TSO on affected wireless interfaces using ethtool -K <iface> tso off gso off until the patched kernel is deployed.
Where feasible, load the MVM driver instead of the MLD driver, since MVM validates amsdu_enabled before the vulnerable computation.
Disable AMSDU features on the wireless adapter through driver module parameters to reduce exposure to the sentinel path.

bash

# Configuration example
sudo ethtool -K wlan0 tso off gso off
sudo modinfo iwlwifi | grep -i amsdu
# Verify kernel includes the fix
zcat /proc/config.gz | grep IWLMLD
uname -r