CVE-2026-64037 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, allowing it to reach the num_subframes calculation:
num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) = (1 + 2) / (1534 + 2) = 0
This zero propagates to iwl_tx_tso_segment() which sets:
gso_size = num_subframes * mss = 0
Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb, NULL deref in tcp_rack_detect_loss).
The MVM driver is immune because it checks mvmsta->amsdu_enabled before reaching the num_subframes calculation. The MLD driver has no equivalent bitmap check and relies solely on max_tid_amsdu_len, which does not catch the sentinel value.
Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability affects the iwlwifi driver in the Linux kernel specifically within the Multi-Link Device (MLD) implementation where Transmission Control Protocol segmentation offload (TSO) operations can trigger an exploitable condition when Adaptive Multi-Stream Data Unit (AMSDU) functionality is disabled. This flaw manifests when the Traffic Load Control (TLC) notification disables AMSDU for a specific Traffic Identifier (TID), causing the MLD driver to set max_tid_amsdu_len to the sentinel value of 1. The TSO segmentation path in iwl_mld_tx_tso_segment() function fails to properly validate this sentinel value, which should be treated equivalent to zero in the context of AMSDU operations. The calculation num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) evaluates to zero when max_tid_amsdu_len equals 1, leading to a cascading effect where gso_size becomes zero and subsequently triggers skb_gso_segment() with invalid parameters.
The operational impact of this vulnerability is severe as the zero gso_size parameter forces skb_gso_segment() to generate an excessive number of micro-frames—over 32000 tiny segments from a single Generic Segmentation Offload (GSO) socket buffer. This massive burst of TX completion events overwhelms the transmit ring with approximately 1024 micro-frames while the remainder are purged, creating conditions that can lead to memory corruption and ultimately result in a use-after-free condition within TCP's retransmit queue. The specific memory corruption manifests as a reference count underflow in tcp_shifted_skb() function followed by a NULL pointer dereference in tcp_rack_detect_loss(), representing a critical reliability and security concern.
The vulnerability stems from the absence of proper sentinel value detection in the MLD driver code path, unlike the Multi-Variable MAC (MVM) driver which implements equivalent bitmap checking through mvmsta->amsdu_enabled before reaching the num_subframes calculation. This architectural difference creates an inconsistent security posture between driver variants within the same wireless subsystem. The fix addresses this inconsistency by detecting the sentinel value max_tid_amsdu_len == 1 at the existing validation point and implementing fallback to non-AMSDU TSO segmentation, effectively neutralizing the exploit vector. Additionally, a defensive programming measure is introduced through WARN_ON_ONCE guard after the num_subframes division to provide early detection of any future code paths that might produce zero values through alternative mechanisms. This vulnerability aligns with CWE-129 and CWE-476 categories related to improper input validation and null pointer dereference respectively, while also mapping to ATT&CK techniques involving privilege escalation through kernel memory corruption and system instability exploitation.