From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5E563A5E67 for ; Sun, 19 Jul 2026 15:40:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475656; cv=none; b=c6076dKT1MLDTK4Ov0RFkIfqnZCTZOq1/z7sXqXLhRzyPzmpgMkWt7dyglz8CvnNO++hD3ktxliA9TizB7HV1vklGRZFmiKeId4prOjlyaKhVBKo884BS1Fyk2jpPADcO0y0Cg+dVDAtk+fvgE7fGVk4s+wlpiI0DQtiR21UmlA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475656; c=relaxed/simple; bh=o3N0Jrh8BY6rDiEgvoxgKhR+hAiZ8alczKSzrQPNjkU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AUM6kZVRT9xQ3Thgv4h3BKykq38TJxrK+Vx9x+XYCL9xky/rPY5Ivxq35HkA0MxGInaXYD80ldMYDnhGEYWQ6ttKk7/hUV6yQdqO8QQmZVq0vee794ZcamggfVIpJ3SjkM0q77ILGR5klE7TjFNR23QWCN/RNh6CnGFrTV/y/rE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sDDJOM/U; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="sDDJOM/U" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B6511F000E9; Sun, 19 Jul 2026 15:40:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784475655; bh=pZJ4Rke9G9UHt8+Ph+2qpK5IMtL3l2ah3SoLiRBZYRo=; h=From:To:Cc:Subject:Date:Reply-To; b=sDDJOM/UNKp0ci7xy8fbVtqBqbRtBnvDvSBjV7uTVe4UQpwucrSCzJykEYxRhzhFB cV4sb28eWiMIZN99ogKoRxkcdDVetucetgRqYsrkE5s1/Pnd91jnoxQ0iBKDZ6BbdB Mza0wubE0dByCS268ogonbF1Nj37wulBe6VzQNyQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64037: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled Date: Sun, 19 Jul 2026 17:38:19 +0200 Message-ID: <2026071905-CVE-2026-64037-3ce2@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3451; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=S92utuR7c1aU1VLFKy5CmHCbxvLuFsQVSdyy3rJzS/s=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx72MPshdtUHX+oea2OMKN+Rnjreazvi9Yer9euLVoz /bXSRWzO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAi9q0MC7bP/bGHb1a26Tf7 XxNP+VgvmzGJz41hrgyjg4iMfnj64SbTaez7Dt3QeDVpIwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, allowing it to reach the num_subframes calculation: num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) = (1 + 2) / (1534 + 2) = 0 This zero propagates to iwl_tx_tso_segment() which sets: gso_size = num_subframes * mss = 0 Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). The MVM driver is immune because it checks mvmsta->amsdu_enabled before reaching the num_subframes calculation. The MLD driver has no equivalent bitmap check and relies solely on max_tid_amsdu_len, which does not catch the sentinel value. Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism. The Linux kernel CVE team has assigned CVE-2026-64037 to this issue. Affected and fixed versions =========================== Issue introduced in 6.15 with commit d1e879ec600f9b3bdd253167533959facfefb17b and fixed in 6.18.34 with commit 9e360e610a73f62432e986775023d5382773f045 Issue introduced in 6.15 with commit d1e879ec600f9b3bdd253167533959facfefb17b and fixed in 7.0.11 with commit cbe1c8245e4469d1aa6e12e5d913611376d23788 Issue introduced in 6.15 with commit d1e879ec600f9b3bdd253167533959facfefb17b and fixed in 7.1 with commit 92cee08dc4f00e77fd1317e4343c5d458b0abab7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64037 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/intel/iwlwifi/mld/tx.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045 https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788 https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7