CVE-2026-64037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64037", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.028Z", "datePublished": "2026-07-19T15:39:25.435Z", "dateUpdated": "2026-10-19T20:28:10.404Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:31.759Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\n\nWhen the TLC notification disables AMSDU for a TID, the MLD driver sets\nmax_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in\niwl_mld_tx_tso_segment() checks for zero but not for this sentinel,\nallowing it to reach the num_subframes calculation:\n\n num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)\n = (1 + 2) / (1534 + 2) = 0\n\nThis zero propagates to iwl_tx_tso_segment() which sets:\n\n gso_size = num_subframes * mss = 0\n\nCalling skb_gso_segment() with gso_size=0 creates over 32000 tiny\nsegments from a single GSO skb. This floods the TX ring with ~1024\nmicro-frames (the rest are purged), creating a massive burst of TX\ncompletion events that can lead to memory corruption and a subsequent\nuse-after-free in TCP's retransmit queue (refcount underflow in\ntcp_shifted_skb, NULL deref in tcp_rack_detect_loss).\n\nThe MVM driver is immune because it checks mvmsta->amsdu_enabled before\nreaching the num_subframes calculation. The MLD driver has no equivalent\nbitmap check and relies solely on max_tid_amsdu_len, which does not\ncatch the sentinel value.\n\nFix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the\nexisting check and falling back to non-AMSDU TSO segmentation. Also add\na WARN_ON_ONCE guard after the num_subframes division as defense-in-depth\nto catch any future code paths that produce zero through a different\nmechanism."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - A remote peer can trigger the vulnerable iwlwifi MLD TX/TSO path by inducing large outbound TCP traffic (responses, uploads, or sustained transfers) on a WiFi 7 Intel system; no adjacent WiFi frame injection or local syscall access is required to reach the bug.\nAC:L - An attacker controls the timing and volume of TCP traffic that produces GSO skbs, and TLC AMSDU-disable notifications are normal firmware rate-adaptation behavior that occurs during routine WiFi use; repeated attempts can reliably hit the sentinel state without conditions outside attacker influence.\nPR:N - Exploitation requires only the ability to generate or solicit network traffic on the victim's WiFi interface; no local account, CAP_NET_ADMIN, or root privileges are needed on the victim host.\nUI:N - No victim user action beyond normal automated network activity is required; a remote attacker can trigger the condition with crafted or high-volume TCP sessions alone.\nS:U - The resulting memory corruption and TCP retransmit-queue UAF occur within kernel/network-driver scope and do not cross a VM, container, or IOMMU security boundary.\nC:H - The fix commit documents memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb), which per kernel guidance enables arbitrary kernel memory read primitives.\nI:H - The same UAF and refcount corruption in the TCP retransmit path can be leveraged for arbitrary kernel writes and potential control-flow hijacking, not merely a bounded data change.\nA:H - The segmentation explosion floods the TX ring with ~1024 micro-frames and a burst of completion events, causing kernel instability including NULL dereference in tcp_rack_detect_loss and system crash/hang."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlwifi/mld/tx.c"], "versions": [{"version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "9e360e610a73f62432e986775023d5382773f045", "status": "affected", "versionType": "git"}, {"version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "cbe1c8245e4469d1aa6e12e5d913611376d23788", "status": "affected", "versionType": "git"}, {"version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "92cee08dc4f00e77fd1317e4343c5d458b0abab7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlwifi/mld/tx.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045"}, {"url": "https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788"}, {"url": "https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7"}], "title": "wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:49.759974Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:28:10.404Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:49.759974Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:35:50.392Z"}}], "cna": {"title": "wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - A remote peer can trigger the vulnerable iwlwifi MLD TX/TSO path by inducing large outbound TCP traffic (responses, uploads, or sustained transfers) on a WiFi 7 Intel system; no adjacent WiFi frame injection or local syscall access is required to reach the bug.\nAC:L - An attacker controls the timing and volume of TCP traffic that produces GSO skbs, and TLC AMSDU-disable notifications are normal firmware rate-adaptation behavior that occurs during routine WiFi use; repeated attempts can reliably hit the sentinel state without conditions outside attacker influence.\nPR:N - Exploitation requires only the ability to generate or solicit network traffic on the victim's WiFi interface; no local account, CAP_NET_ADMIN, or root privileges are needed on the victim host.\nUI:N - No victim user action beyond normal automated network activity is required; a remote attacker can trigger the condition with crafted or high-volume TCP sessions alone.\nS:U - The resulting memory corruption and TCP retransmit-queue UAF occur within kernel/network-driver scope and do not cross a VM, container, or IOMMU security boundary.\nC:H - The fix commit documents memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb), which per kernel guidance enables arbitrary kernel memory read primitives.\nI:H - The same UAF and refcount corruption in the TCP retransmit path can be leveraged for arbitrary kernel writes and potential control-flow hijacking, not merely a bounded data change.\nA:H - The segmentation explosion floods the TX ring with ~1024 micro-frames and a burst of completion events, causing kernel instability including NULL dereference in tcp_rack_detect_loss and system crash/hang."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "9e360e610a73f62432e986775023d5382773f045", "versionType": "git"}, {"status": "affected", "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "cbe1c8245e4469d1aa6e12e5d913611376d23788", "versionType": "git"}, {"status": "affected", "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "lessThan": "92cee08dc4f00e77fd1317e4343c5d458b0abab7", "versionType": "git"}], "programFiles": ["drivers/net/wireless/intel/iwlwifi/mld/tx.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/intel/iwlwifi/mld/tx.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045"}, {"url": "https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788"}, {"url": "https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\n\nWhen the TLC notification disables AMSDU for a TID, the MLD driver sets\nmax_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in\niwl_mld_tx_tso_segment() checks for zero but not for this sentinel,\nallowing it to reach the num_subframes calculation:\n\n num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)\n = (1 + 2) / (1534 + 2) = 0\n\nThis zero propagates to iwl_tx_tso_segment() which sets:\n\n gso_size = num_subframes * mss = 0\n\nCalling skb_gso_segment() with gso_size=0 creates over 32000 tiny\nsegments from a single GSO skb. This floods the TX ring with ~1024\nmicro-frames (the rest are purged), creating a massive burst of TX\ncompletion events that can lead to memory corruption and a subsequent\nuse-after-free in TCP's retransmit queue (refcount underflow in\ntcp_shifted_skb, NULL deref in tcp_rack_detect_loss).\n\nThe MVM driver is immune because it checks mvmsta->amsdu_enabled before\nreaching the num_subframes calculation. The MLD driver has no equivalent\nbitmap check and relies solely on max_tid_amsdu_len, which does not\ncatch the sentinel value.\n\nFix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the\nexisting check and falling back to non-AMSDU TSO segmentation. Also add\na WARN_ON_ONCE guard after the num_subframes division as defense-in-depth\nto catch any future code paths that produce zero through a different\nmechanism."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:31.759Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64037", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:42:20.540Z", "dateReserved": "2026-07-19T07:54:57.028Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T15:39:25.435Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlwifi/mld/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9e360e610a73f62432e986775023d5382773f045", "status": "affected", "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "versionType": "git"}, {"lessThan": "cbe1c8245e4469d1aa6e12e5d913611376d23788", "status": "affected", "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "versionType": "git"}, {"lessThan": "92cee08dc4f00e77fd1317e4343c5d458b0abab7", "status": "affected", "version": "d1e879ec600f9b3bdd253167533959facfefb17b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlwifi/mld/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "89E9B97C-FD82-4D2E-8426-3A1A703B2ED7", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\n\nWhen the TLC notification disables AMSDU for a TID, the MLD driver sets\nmax_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in\niwl_mld_tx_tso_segment() checks for zero but not for this sentinel,\nallowing it to reach the num_subframes calculation:\n\n num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)\n = (1 + 2) / (1534 + 2) = 0\n\nThis zero propagates to iwl_tx_tso_segment() which sets:\n\n gso_size = num_subframes * mss = 0\n\nCalling skb_gso_segment() with gso_size=0 creates over 32000 tiny\nsegments from a single GSO skb. This floods the TX ring with ~1024\nmicro-frames (the rest are purged), creating a massive burst of TX\ncompletion events that can lead to memory corruption and a subsequent\nuse-after-free in TCP's retransmit queue (refcount underflow in\ntcp_shifted_skb, NULL deref in tcp_rack_detect_loss).\n\nThe MVM driver is immune because it checks mvmsta->amsdu_enabled before\nreaching the num_subframes calculation. The MLD driver has no equivalent\nbitmap check and relies solely on max_tid_amsdu_len, which does not\ncatch the sentinel value.\n\nFix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the\nexisting check and falling back to non-AMSDU TSO segmentation. Also add\na WARN_ON_ONCE guard after the num_subframes division as defense-in-depth\nto catch any future code paths that produce zero through a different\nmechanism."}], "id": "CVE-2026-64037", "lastModified": "2026-10-19T21:17:21.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64037", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:35:49.759974Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:43.947", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/92cee08dc4f00e77fd1317e4343c5d458b0abab7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9e360e610a73f62432e986775023d5382773f045"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cbe1c8245e4469d1aa6e12e5d913611376d23788"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled", "id": "2502518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502518"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled\nWhen the TLC notification disables AMSDU for a TID, the MLD driver sets\nmax_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in\niwl_mld_tx_tso_segment() checks for zero but not for this sentinel,\nallowing it to reach the num_subframes calculation:\nnum_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad)\n= (1 + 2) / (1534 + 2) = 0\nThis zero propagates to iwl_tx_tso_segment() which sets:\ngso_size = num_subframes * mss = 0\nCalling skb_gso_segment() with gso_size=0 creates over 32000 tiny\nsegments from a single GSO skb. This floods the TX ring with ~1024\nmicro-frames (the rest are purged), creating a massive burst of TX\ncompletion events that can lead to memory corruption and a subsequent\nuse-after-free in TCP's retransmit queue (refcount underflow in\ntcp_shifted_skb, NULL deref in tcp_rack_detect_loss).\nThe MVM driver is immune because it checks mvmsta->amsdu_enabled before\nreaching the num_subframes calculation. The MLD driver has no equivalent\nbitmap check and relies solely on max_tid_amsdu_len, which does not\ncatch the sentinel value.\nFix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the\nexisting check and falling back to non-AMSDU TSO segmentation. Also add\na WARN_ON_ONCE guard after the num_subframes division as defense-in-depth\nto catch any future code paths that produce zero through a different\nmechanism.", "A flaw was found in the Linux kernel's iwlwifi MLD driver. When the Aggregated MAC Service Data Unit (AMSDU) feature is disabled, the driver incorrectly processes Transmit Segmentation Offload (TSO) requests. This can lead to a flood of micro-frames on the transmit ring, resulting in memory corruption and a use-after-free vulnerability. Exploitation of this flaw could allow an attacker to cause system instability or potentially execute arbitrary code."], "name": "CVE-2026-64037", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64037\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64037\nhttps://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-64037-3ce2@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d1e879ec600f9b3bdd253167533959facfefb17b,9e360e610a73f62432e986775023d5382773f045)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d1e879ec600f9b3bdd253167533959facfefb17b,cbe1c8245e4469d1aa6e12e5d913611376d23788)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d1e879ec600f9b3bdd253167533959facfefb17b,92cee08dc4f00e77fd1317e4343c5d458b0abab7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T09:30:04.459941+00:00", "updated": "2026-10-20T03:15:08.405729+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-20", "CWE-476"]}