SB20260720202 - Use-after-free in Linux kernel iwlwifi mld driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-64037)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and trigger a use-after-free.

The vulnerability exists due to a use-after-free in iwl_mld_tx_tso_segment() in the iwlwifi MLD driver when processing TSO segmentation with AMSDU disabled for a TID. A local user can trigger TSO segmentation that produces zero subframes to cause a denial of service and trigger a use-after-free.

The issue occurs when the AMSDU length field is set to the sentinel value 1, which causes gso_size to become 0 and leads to excessive packet segmentation and TX completion activity.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7
• https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045
• https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788