Executive brief
A vulnerability in the Linux kernel's Intel Wi-Fi driver (iwlwifi) can cause system instability when the Wi-Fi hardware restarts. During a firmware crash, the system may enter a high-speed loop of failed data transmissions, consuming excessive CPU resources and memory. This could lead to a denial-of-service condition where the computer becomes sluggish or unresponsive during network recovery.
Technical details
A flaw in the iwlwifi MLD (Multi-Link Device) sub-driver fails to check the 'in_hw_restart' flag within the iwl_mld_tx_from_txq() function. When the firmware crashes, the driver continues to dequeue frames from the mac80211 layer and attempts to push them to the transport layer, which returns -EIO errors. Under high-throughput conditions, this results in a tight dequeue-send-fail-free loop, causing significant CPU overhead and memory pressure due to rapid socket buffer (skb) allocation churn and slab fragmentation. The issue is resolved by adding a guard to stop TX operations while the hardware is restarting. Patches are available in stable kernel branches 6.18.34, 7.0.11, and 7.1.
Affected products
- Linux Linux Kernel 6.15 to 6.18.33, 6.19 to 7.0.10
Timeline
- 2026-03-15: disclosed: Initial patch submission by Sheroz Juraev
- 2026-06-01: patched: Commits merged into stable trees by Greg Kroah-Hartman
- 2026-07-19: advisory: NVD publication of CVE-2026-64175