CVE-2026-64175

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwlwifi: mld: stop TX during firmware restart<br /> <br /> When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel<br /> BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld-&gt;fw_status.in_hw_restart<br /> to true. However, iwl_mld_tx_from_txq() does not check this flag before<br /> dequeuing frames from mac80211 and pushing them to the transport layer.<br /> <br /> Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame,<br /> which then gets freed immediately. Under high-throughput conditions<br /> (e.g., Tailscale UDP traffic or active SSH sessions), this creates a<br /> tight dequeue-send-fail-free loop that wastes CPU cycles and generates<br /> rapid skb allocation churn, leading to memory pressure from slab<br /> fragmentation.<br /> <br /> The RX path already has this guard (iwl_mld_rx_mpdu checks<br /> in_hw_restart at rx.c:1906), and so does the TXQ allocation worker<br /> (iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to<br /> iwl_mld_tx_from_txq() to stop all TX during firmware restart.<br /> <br /> Frames left in mac80211&amp;#39;s TXQs are naturally drained after restart<br /> completes, when queue reallocation triggers iwl_mld_tx_from_txq()<br /> via iwl_mld_add_txq_list(), or when new upper-layer traffic invokes<br /> wake_tx_queue.<br /> <br /> Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on<br /> kernel 6.19.5 where the firmware crashes approximately every 10-15<br /> minutes under Tailscale traffic.