CVE-2026-64037: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled

When the TLC notification disables AMSDU for a TID, the MLD driver sets
max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in
iwl_mld_tx_tso_segment() checks for zero but not for this sentinel,
allowing it to reach the num_subframes calculation:

  num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)
                = (1 + 2) / (1534 + 2) = 0

This zero propagates to iwl_tx_tso_segment() which sets:

  gso_size = num_subframes * mss = 0

Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny
segments from a single GSO skb. This floods the TX ring with ~1024
micro-frames (the rest are purged), creating a massive burst of TX
completion events that can lead to memory corruption and a subsequent
use-after-free in TCP's retransmit queue (refcount underflow in
tcp_shifted_skb, NULL deref in tcp_rack_detect_loss).

The MVM driver is immune because it checks mvmsta->amsdu_enabled before
reaching the num_subframes calculation. The MLD driver has no equivalent
bitmap check and relies solely on max_tid_amsdu_len, which does not
catch the sentinel value.

Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the
existing check and falling back to non-AMSDU TSO segmentation. Also add
a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth
to catch any future code paths that produce zero through a different
mechanism.

The Linux kernel CVE team has assigned CVE-2026-64037 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit d1e879ec600f9b3bdd253167533959facfefb17b and fixed in 6.18.34 with commit 9e360e610a73f62432e986775023d5382773f045
	Issue introduced in 6.15 with commit d1e879ec600f9b3bdd253167533959facfefb17b and fixed in 7.0.11 with commit cbe1c8245e4469d1aa6e12e5d913611376d23788
	Issue introduced in 6.15 with commit d1e879ec600f9b3bdd253167533959facfefb17b and fixed in 7.1 with commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64037
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/intel/iwlwifi/mld/tx.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045
	https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788
	https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7