CVE-2026-64255 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[].
Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides in the iwlwifi driver within the Linux kernel, specifically affecting multi-link device implementations that handle block acknowledgment sessions. This issue manifests in three distinct BA session handlers where the function ffs() is called on the sta_mask field without proper validation of whether this field contains a non-zero value. The flaw represents a classic case of improper input validation that can lead to memory corruption through out-of-bounds array access patterns.
The technical implementation of this vulnerability stems from the direct usage of ffs(ba_data->sta_mask) - 1 to calculate a station identifier for accessing the fw_id_to_link_sta[] array. When the sta_mask field equals zero, the ffs() function correctly returns zero, but the subsequent subtraction operation causes integer underflow resulting in the value 0xFFFFFFFF. This invalid index then gets used to access the fw_id_to_link_sta[] array, leading to memory corruption and potential privilege escalation or system instability. The vulnerability falls under CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories, representing a clear violation of safe programming practices.
The operational impact of this vulnerability extends beyond simple memory corruption as it can be exploited by malicious actors to compromise system integrity and potentially execute arbitrary code with kernel privileges. The affected BA session handlers are part of the wireless networking stack's multi-link device support, making this particularly dangerous in environments where wireless connectivity is critical and where attackers might attempt to leverage this flaw through crafted network packets or malicious wireless devices. This vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter and T1068 Exploitation for Privilege Escalation, as it provides a pathway for kernel-level code execution.
The mitigation strategy involves implementing proper input validation through WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, ensuring that the sta_mask field contains valid data before proceeding with calculations. This approach mirrors the existing validation pattern already present in the iwl_mld_ampdu_rx_start() function, providing consistency in defensive programming practices. The fix ensures that zero-valued sta_mask fields are properly detected and handled, preventing the integer underflow condition that leads to memory corruption. This defensive measure maintains system stability while preserving the intended functionality of the wireless networking subsystem, demonstrating proper adherence to secure coding standards and kernel security best practices through the implementation of early input validation checks.