CVE-2026-64176: Linux Kernel iwlwifi Rate Handling Flaw

CVE-2026-64176 Overview

CVE-2026-64176 is a Linux kernel vulnerability in the iwlwifi Intel wireless driver's mvm module. The flaw affects driver-set TX rate handling on older Intel Wi-Fi devices such as the 7265D. A regression in the rate encoding logic caused TX_CMD rates to be set incorrectly, potentially triggering firmware warnings when the device reported the used rate back to the driver. The issue stems from an incomplete revert of changes introduced during the migration from version 1 (v1) to version 3 (v3) rate encoding. Beacon rate handling was restored to prevent firmware asserts, but real TX_CMD rate handling was left broken.

Critical Impact
An adjacent-network attacker within Wi-Fi range can exploit malformed TX rate handling to trigger firmware crashes and denial-of-service conditions on affected Linux hosts using legacy Intel wireless chipsets.

Affected Products

Linux kernel iwlwifi driver (mvm module)
Intel wireless devices using v1 rate encoding, including Intel Wireless 7265D
Linux distributions shipping vulnerable stable kernel branches

Discovery Timeline

2026-07-19 - CVE-2026-64176 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64176

Vulnerability Analysis

The vulnerability resides in the iwl_mvm_mac80211_idx_to_hwrate() function within the iwlwifi mvm driver. Older Intel Wi-Fi hardware such as the 7265D encodes rates in v1 format. The v1 format does not use CCK/OFDM rate indices (0-3 or 0-7). Instead, it uses PLCP (Physical Layer Convergence Procedure) values, for example 10 for the 1 Mbps CCK rate.

During the introduction of v3 rate encoding, the driver was refactored to internally handle v3 rates and convert to v1 or v2 based on the firmware version. The conversion function was updated to return only the rate index regardless of API version. That change was later partially reverted because it broke beacon rates and caused firmware asserts. The revert restored beacon transmission but corrupted TX_CMD rate values reported to the firmware.

Root Cause

The root cause is an incorrect scope of a prior revert. The revert applied PLCP-value logic to all TX paths instead of isolating it to beacon rate handling embedded in the beacon template command. As a result, standard TX_CMD frames were populated with mismatched rate representations for v1 devices.

Attack Vector

Exploitation requires adjacent network access, meaning an attacker must be within wireless range of a vulnerable host. Crafted wireless traffic that induces specific TX rate selection paths can cause firmware assertions on the wireless adapter. This results in driver warnings, adapter resets, and loss of wireless connectivity on affected Linux systems.

No verified public exploit code exists for this vulnerability. The fix is available in upstream commits 6b58a79, 6fe92651, and fb84b5cb, which restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index and handle beacon rates separately in the beacon template command.

Detection Methods for CVE-2026-64176

Indicators of Compromise

Kernel log entries from iwlwifi reporting unexpected TX rate values used by firmware.
Firmware assertion messages or driver warnings referencing TX_CMD rate mismatches.
Unexplained wireless adapter resets or link drops on hosts using Intel 7265D and similar legacy chipsets.

Detection Strategies

Monitor dmesg and journalctl -k for iwlwifi warnings, firmware asserts, or micro-code errors.
Correlate wireless disconnection events with kernel driver log signatures across managed Linux endpoints.
Inventory Linux hosts running affected kernel versions with Intel wireless hardware in the v1 rate family.

Monitoring Recommendations

Aggregate kernel and Wi-Fi driver logs from Linux endpoints into a centralized logging or SIEM platform.
Alert on repeated iwlwifi firmware reload events on the same host within short intervals.
Track kernel version drift across the fleet to identify hosts pending patch deployment.

How to Mitigate CVE-2026-64176

Immediate Actions Required

Update affected Linux systems to a kernel release incorporating commits 6b58a79, 6fe92651, or fb84b5cb.
Prioritize patching mobile and portable Linux endpoints operating in untrusted wireless environments.
Audit deployed hardware to identify hosts running Intel 7265D and other v1-rate wireless adapters.

Patch Information

The fix is upstream in the Linux stable tree. Apply the vendor kernel update from your Linux distribution that includes the referenced commits. The patch restores iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index and handles beacon rates in the TX_CMD embedded in the beacon template command separately.

Workarounds

Disable the wireless interface on affected hosts when operating in untrusted RF environments until patches are applied.
Restrict wireless connectivity to trusted, controlled networks to reduce adjacent-network exposure.
Replace legacy Intel 7265D adapters with hardware that uses newer rate encoding APIs where feasible.

bash

# Verify kernel version and iwlwifi module details
uname -r
modinfo iwlwifi | grep -E '^(version|filename):'

# Temporarily disable the iwlwifi driver until patched
sudo modprobe -r iwlmvm iwlwifi

# Prevent auto-load until patched kernel is installed
echo 'blacklist iwlwifi' | sudo tee /etc/modprobe.d/disable-iwlwifi.conf