CVE-2026-64255 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
An integer underflow in the iwlwifi driver causes out-of-bounds memory access when handling Block Ack sessions with a zero station mask, potentially leading to system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64255?
CVE-2026-64255 is a high-severity vulnerability in Linux kernel, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[].
Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().
Weakness: CWE-125
Which versions are affected by CVE-2026-64255?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64255?
Apply the vendor's patch.
Is CVE-2026-64255 being exploited?
There is no known exploitation of CVE-2026-64255 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93351, BELL-CVE-2026-64255, DEBIAN-CVE-2026-64255, GHSA-3prq-7cqf-r4ww, ROOT-OS-DEBIAN-13-CVE-2026-64255, ROOT-OS-UBUNTU-2204-CVE-2026-64255 and 1 more.