CVE-2026-64212: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64212 Overview

CVE-2026-64212 is a null pointer dereference vulnerability in the Linux kernel's Intel wireless driver (iwlwifi) multi-link device (mld) subsystem. The flaw exists in the iwl_mld_remove_link function, which dereferences a link pointer to save link->fw_id before validating that the pointer is non-NULL. The issue was introduced by a prior fix (commit 0e66a39f4f0e) intended to address a use-after-free condition in the same function. The upstream resolution moves the free operation to the end of the function, eliminating the need for the early dereference.

Critical Impact
A NULL pointer dereference in kernel space triggers a kernel oops, resulting in denial of service on systems using Intel Wi-Fi hardware with the mld driver path.

Affected Products

Linux kernel versions containing commit 0e66a39f4f0e in the iwlwifi mld driver
Systems using Intel Wi-Fi adapters that load the iwlwifi multi-link device driver
Distributions shipping kernels with the affected iwl_mld_remove_link code path

Discovery Timeline

2026-07-24 - CVE-2026-64212 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64212

Vulnerability Analysis

The defect resides in the iwl_mld_remove_link function within the Intel iwlwifi multi-link device driver. The function stores link->fw_id at its entry point so the identifier remains available after the link structure is freed. However, the code does not verify that link is non-NULL before performing this dereference. When the function is invoked with a NULL link argument, the kernel dereferences an invalid address and generates a fault.

The original commit 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()") corrected a use-after-free but introduced this ordering flaw. The fix reorders the operations so the link is freed at the end of the function, removing the need to cache fw_id before a NULL check.

Root Cause

The root cause is an unchecked pointer dereference preceding a NULL validation. The function assumed link would always be valid at entry, but callers can legitimately pass NULL. This falls under kernel-level null pointer dereference weakness patterns.

Attack Vector

The attack vector is local. Triggering the code path requires interaction with the iwlwifi mld driver on hardware with an Intel Wi-Fi adapter. Exploitation results in a kernel oops and denial of service rather than code execution or privilege escalation. No public proof-of-concept or known exploitation has been reported.

No verified code examples are available. See the upstream commits for the technical fix: Kernel Git Commit 3a74aaad, Kernel Git Commit b6b4db85, and Kernel Git Commit d733ed48.

Detection Methods for CVE-2026-64212

Indicators of Compromise

Kernel oops or panic messages referencing iwl_mld_remove_link in dmesg or /var/log/kern.log
Unexpected iwlwifi driver crashes or Wi-Fi interface resets on affected hardware
Stack traces in kernel logs showing NULL pointer dereference within the iwlwifi mld code path

Detection Strategies

Audit installed kernel versions against the fixed upstream commits 3a74aaad, b6b4db85, and d733ed48
Monitor kernel crash reporting systems (kdump, ABRT, systemd-coredump) for faults originating in iwlwifi
Correlate wireless connectivity failures with kernel log events referencing the mld subsystem

Monitoring Recommendations

Ingest kernel logs into a centralized log platform and alert on BUG: kernel NULL pointer dereference entries tied to iwlwifi
Track fleet-wide kernel versions to identify unpatched endpoints running Intel Wi-Fi hardware
Review wireless subsystem stability metrics after link teardown operations

How to Mitigate CVE-2026-64212

Immediate Actions Required

Update the Linux kernel to a version containing the upstream fix commits 3a74aaad, b6b4db85, or d733ed48
Apply distribution vendor kernel updates as they become available for affected stable branches
Inventory endpoints using Intel Wi-Fi adapters with the iwlwifi mld driver

Patch Information

The fix restructures iwl_mld_remove_link so the link is freed at the end of the function, removing the early dereference of link->fw_id. Upstream fixes are available in the stable kernel tree via commits 3a74aaad, b6b4db85, and d733ed48.

Workarounds

Disable the iwlwifi module on systems that do not require Intel Wi-Fi functionality using modprobe -r iwlwifi and blacklisting
Restrict local access to systems running vulnerable kernels until patches are applied
Use wired network connectivity as a temporary alternative on affected endpoints

bash

# Verify current kernel version and iwlwifi module status
uname -r
lsmod | grep iwlwifi

# Temporary mitigation: unload and blacklist the module
sudo modprobe -r iwlmld iwlwifi
echo "blacklist iwlwifi" | sudo tee /etc/modprobe.d/blacklist-iwlwifi.conf