CVE-2026-64175: Linux Kernel iwlwifi DoS Vulnerability

CVE-2026-64175 Overview

CVE-2026-64175 is a Linux kernel vulnerability in the iwlwifi Intel wireless driver's Multi-Link Device (MLD) subsystem. When the firmware crashes on affected Intel Wi-Fi hardware such as the BE201 (Wi-Fi 7), the transmit path continues to dequeue frames from mac80211 and push them to a dead transport layer. Each frame fails with -EIO and is immediately freed, creating a tight dequeue-send-fail-free loop. Under high-throughput traffic conditions, this loop consumes CPU cycles and triggers rapid skb allocation churn, producing memory pressure through slab fragmentation.

Critical Impact
Attackers or unstable firmware conditions can trigger sustained CPU exhaustion and memory pressure on affected Linux hosts, resulting in denial of service on systems using Intel Wi-Fi 7 hardware.

Affected Products

Linux kernel builds containing the iwlwifi MLD driver prior to the fix commits
Systems using Intel BE201 and other Wi-Fi 7 adapters managed by iwl_mld_tx_from_txq()
Confirmed reproduction on Linux kernel 6.19.5 with ASUS Zenbook 14 UX3405CA

Discovery Timeline

2026-07-19 - CVE-2026-64175 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64175

Vulnerability Analysis

The defect resides in the iwlwifi driver's transmit queue handler for the Multi-Link Device architecture. When firmware fails, for example with NMI_INTERRUPT_UNKNOWN, the error handler iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. This flag signals that the hardware is undergoing recovery and that operations targeting the transport layer will fail.

The receive path already respects this flag. iwl_mld_rx_mpdu checks in_hw_restart at rx.c:1906, and the TXQ allocation worker iwl_mld_add_txqs_wk performs the same check at tx.c:156. The transmit dequeue function iwl_mld_tx_from_txq() lacked this guard, allowing it to continue calling iwl_trans_tx() against a non-functional firmware.

Root Cause

The root cause is a missing state check in the transmit dequeue path. Without inspecting fw_status.in_hw_restart, the driver treats a crashed firmware as operational. Each attempted transmit returns -EIO, the frame is freed, and mac80211 immediately supplies another queued frame. The lack of coordination between the firmware restart state and the TX worker produces uncontrolled resource consumption until the restart completes.

Attack Vector

Exploitation requires the firmware to enter a crashed state, which occurs organically under real workloads such as Tailscale UDP traffic or active SSH sessions on affected Intel Wi-Fi 7 hardware. Once the crash occurs, any process generating outbound traffic through mac80211 sustains the dequeue-fail-free loop. The attack vector is scored as network-adjacent because remote traffic patterns that keep TXQs populated extend the duration and intensity of the resource exhaustion. There is no memory corruption or code execution component. The impact is confined to availability through CPU saturation and slab fragmentation.

No verified exploit code is publicly available. The upstream fix and technical details are documented in the Kernel Git Commit 1, Kernel Git Commit 2, and Kernel Git Commit 3.

Detection Methods for CVE-2026-64175

Indicators of Compromise

Kernel log entries showing repeated iwlwifi firmware errors such as NMI_INTERRUPT_UNKNOWN followed by sustained high CPU usage in softirq or kernel worker threads.
Rapid growth in skb slab allocator counters visible through /proc/slabinfo immediately after a firmware crash event.
Persistent -EIO return codes from the wireless transmit path recorded in kernel tracepoints while in_hw_restart is asserted.

Detection Strategies

Monitor dmesg and journalctl -k for iwl_mld_nic_error and firmware restart messages correlated with CPU spikes.
Use perf top or bpftrace to identify hot paths in iwl_mld_tx_from_txq and iwl_trans_tx during suspected events.
Track mac80211 TXQ statistics and interface throughput drops that coincide with firmware recovery cycles.

Monitoring Recommendations

Alert on repeated firmware restart events on hosts equipped with Intel BE201 or other Wi-Fi 7 adapters.
Baseline slab memory usage and generate alerts when skb-related caches grow abnormally following a wireless subsystem error.
Correlate kernel wireless subsystem errors with endpoint telemetry to detect sustained availability degradation on mobile and laptop fleets.

How to Mitigate CVE-2026-64175

Immediate Actions Required

Apply the upstream kernel patches referenced in the git commits and rebuild or update affected kernels.
Prioritize patching on laptops and workstations equipped with Intel BE201 and other Wi-Fi 7 chipsets using the iwlwifi MLD driver.
Reduce sustained high-throughput wireless workloads on unpatched hosts until updates can be deployed.

Patch Information

The fix adds an in_hw_restart check to iwl_mld_tx_from_txq(), mirroring the guards already present in the RX path and TXQ allocation worker. Frames left in mac80211 TXQs drain naturally after restart, when queue reallocation invokes iwl_mld_tx_from_txq() via iwl_mld_add_txq_list(), or when new upper-layer traffic triggers wake_tx_queue. The corrective commits are available in the Kernel Git Commit 1, Kernel Git Commit 2, and Kernel Git Commit 3.

Workarounds

Disable the affected wireless interface during firmware instability using ip link set wlan0 down until a patched kernel is installed.
Switch to a wired connection on affected devices experiencing recurrent firmware crashes.
Load an alternative firmware image or downgrade to a driver revision that does not exhibit the crash pattern where feasible.

bash

# Verify running kernel and iwlwifi module status after patching
uname -r
modinfo iwlwifi | grep -E 'version|filename'
dmesg | grep -iE 'iwlwifi|in_hw_restart|NMI_INTERRUPT'