CVE-2026-64037

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled<br /> <br /> When the TLC notification disables AMSDU for a TID, the MLD driver sets<br /> max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in<br /> iwl_mld_tx_tso_segment() checks for zero but not for this sentinel,<br /> allowing it to reach the num_subframes calculation:<br /> <br /> num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)<br /> = (1 + 2) / (1534 + 2) = 0<br /> <br /> This zero propagates to iwl_tx_tso_segment() which sets:<br /> <br /> gso_size = num_subframes * mss = 0<br /> <br /> Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny<br /> segments from a single GSO skb. This floods the TX ring with ~1024<br /> micro-frames (the rest are purged), creating a massive burst of TX<br /> completion events that can lead to memory corruption and a subsequent<br /> use-after-free in TCP&amp;#39;s retransmit queue (refcount underflow in<br /> tcp_shifted_skb, NULL deref in tcp_rack_detect_loss).<br /> <br /> The MVM driver is immune because it checks mvmsta-&gt;amsdu_enabled before<br /> reaching the num_subframes calculation. The MLD driver has no equivalent<br /> bitmap check and relies solely on max_tid_amsdu_len, which does not<br /> catch the sentinel value.<br /> <br /> Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the<br /> existing check and falling back to non-AMSDU TSO segmentation. Also add<br /> a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth<br /> to catch any future code paths that produce zero through a different<br /> mechanism.