Riskcovery

CVE-2026-64255

wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

State
Published
Severity
8.8 High
Published
Jul 24, 2026
Updated
Oct 19, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[].

Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 9aa3856d9b6f3f8bf085b5bbb5f3703578bf452b to before 1de92789ce31e46fa7e7d8e89c90b19cdb1c103bAffected
  • 9aa3856d9b6f3f8bf085b5bbb5f3703578bf452b to before fe7f339f63c9dc4ca546ed7ac38ba4bb3a99dcfcAffected
  • 9aa3856d9b6f3f8bf085b5bbb5f3703578bf452b to before f056fc2b927448d37eca6b6cacc3d1b0f67b20d2Affected
LinuxLinux
  • 6.4Affected
  • before 6.4Not affected
  • 6.18.38 through 6.18.*Not affected
  • 7.1.3 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.