CVE-2026-64506 wifi: rtw89: correct drop logic for malformed AMPDU frames
A flaw in the rtw89 WiFi driver causes unexpected packet drops and disconnections during rekeying, leading to denial of service for nearby attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64506?
CVE-2026-64506 is a denial of service vulnerability in Linux, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: correct drop logic for malformed AMPDU frames
The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence number, and leads to unexpected packet drop. It is more likely to encounter this failure when there are busy traffic during rekey process and could lead to disconnection from the AP. Fix this by adding a initial state judgement and only reset status during pairwise rekey.
Which versions are affected by CVE-2026-64506?
How do I fix CVE-2026-64506?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64506 being exploited?
There is no known exploitation of CVE-2026-64506 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-64506, GHSA-r9fc-rvh2-m2x5, ROOT-OS-UBUNTU-2204-CVE-2026-64506, UBUNTU-CVE-2026-64506.