CVE-2026-64255 Overview
CVE-2026-64255 is an out-of-bounds access vulnerability in the Linux kernel's iwlwifi Intel Wi-Fi driver. The flaw resides in the mld (Multi-Link Device) component's Block Ack (BA) session handlers. Three handlers call ffs(ba_data->sta_mask) - 1 to derive a station ID without validating that sta_mask is non-zero. When sta_mask equals zero, ffs() returns 0 and the subtraction underflows to 0xFFFFFFFF, causing an out-of-bounds access on the fw_id_to_link_sta[] array. An attacker within Wi-Fi range can leverage this condition to compromise confidentiality, integrity, and availability of the affected host.
Critical Impact
An adjacent-network attacker can trigger an out-of-bounds memory access in the kernel, leading to memory corruption, information disclosure, or denial of service on systems running vulnerable Intel Wi-Fi drivers.
Affected Products
- Linux kernel versions containing the iwlwifimld driver with unpatched BA session handlers
- Systems using Intel Wi-Fi hardware managed by the iwlwifi Multi-Link Device driver
- Linux distributions shipping affected upstream kernel builds prior to the referenced stable commits
Discovery Timeline
- 2026-07-24 - CVE-2026-64255 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64255
Vulnerability Analysis
The vulnerability affects three Block Ack (BA) session handlers in the iwlwifi Multi-Link Device (mld) driver. Each handler uses the expression ffs(ba_data->sta_mask) - 1 to convert the station bitmask into an array index. The ffs() (find-first-set) function returns the position of the least significant set bit, or 0 when the input is zero.
When sta_mask is zero, the calculation produces 0 - 1, which wraps to 0xFFFFFFFF under unsigned arithmetic. The driver then uses this value as an index into fw_id_to_link_sta[], resulting in an out-of-bounds read or write far outside the intended array. This class of defect falls under Out-of-Bounds Access and Integer Underflow.
Because the affected code path executes in kernel context on receipt of BA session events over Wi-Fi, an adjacent-network attacker can influence the conditions under which sta_mask becomes zero. The impact includes kernel memory corruption, potential information disclosure, and system crashes.
Root Cause
The root cause is missing input validation. The existing iwl_mld_ampdu_rx_start() function guards the same computation with a WARN_ON_ONCE(!ba_data->sta_mask) check, but three additional BA session handlers did not adopt this defensive pattern. The fix adds equivalent WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call to prevent the underflow.
Attack Vector
Exploitation requires adjacency to the target's Wi-Fi network. An attacker on the same wireless network segment can send crafted 802.11 frames that trigger BA session handler paths on the victim system. If the driver enters these paths with a zeroed sta_mask, the resulting out-of-bounds access corrupts kernel memory or causes a crash. No authentication or user interaction is required. See the upstream commits for the exact code paths: kernel commit 1de92789, kernel commit f056fc2b, and kernel commit fe7f339f.
Detection Methods for CVE-2026-64255
Indicators of Compromise
- Kernel WARN_ON traces referencing iwlwifi, mld, or BA session handler functions after applying the patch
- Unexpected kernel oops or panic entries citing fw_id_to_link_sta or ffs in the call trace
- Repeated Wi-Fi driver crashes or iwlwifi firmware restarts on affected hosts near untrusted wireless networks
Detection Strategies
- Inventory Linux endpoints running iwlwifi with the mld driver and cross-reference kernel versions against the fixed stable commits
- Monitor dmesg and journald for iwlwifi warnings, out-of-bounds reports from KASAN-enabled kernels, and BA session anomalies
- Correlate wireless network anomalies with endpoint kernel crash telemetry to identify adjacent-network exploitation attempts
Monitoring Recommendations
- Centralize kernel log collection from Linux endpoints and alert on iwlwifi crash signatures
- Track Wi-Fi driver reload events and firmware exceptions to surface abnormal frequency spikes
- Baseline BA session activity on managed wireless infrastructure to detect crafted frame patterns from rogue clients
How to Mitigate CVE-2026-64255
Immediate Actions Required
- Update Linux kernels on all endpoints and servers using Intel Wi-Fi hardware to a version that includes the upstream fix
- Prioritize patching mobile and portable Linux systems that connect to untrusted or public Wi-Fi networks
- Enable kernel hardening options such as KASAN in test environments to surface remaining out-of-bounds conditions
Patch Information
The fix adds WARN_ON_ONCE(!ba_data->sta_mask) validation before each ffs() call in the three affected BA session handlers, matching the existing guard in iwl_mld_ampdu_rx_start(). Apply the stable kernel commits 1de92789ce31, f056fc2b9274, and fe7f339f63c9, or upgrade to a distribution kernel that includes these changes.
Workarounds
- Disable the iwlwifi driver on systems that do not require Intel Wi-Fi connectivity using modprobe -r iwlwifi and a blacklist entry
- Restrict affected hosts to trusted wired networks until the kernel patch is deployed
- Avoid connecting vulnerable devices to open or attacker-controlled wireless networks
# Blacklist the iwlwifi driver until the kernel is patched
echo "blacklist iwlwifi" | sudo tee /etc/modprobe.d/disable-iwlwifi.conf
sudo modprobe -r iwlmvm iwlwifi
# Verify the running kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
