Executive brief
A vulnerability in the Intel Wi-Fi driver (iwlwifi) for the Linux kernel could cause system instability or crashes on older hardware. The issue stems from how the driver communicates data transmission speeds to the device's firmware, specifically on older models like the Intel 7265D. If exploited or triggered by specific network conditions, this could lead to a firmware crash, resulting in a loss of wireless connectivity.
Technical details
A regression in the iwlwifi mvm driver caused incorrect encoding of transmission (TX) rates for older devices (e.g., 7265D) that utilize version 1 rate formats. The root cause was an incorrect implementation in iwl_mvm_mac80211_idx_to_hwrate() which failed to distinguish between rate indices and PLCP values required by different firmware API versions. This mismatch can trigger firmware assertions or crashes when processing beacon templates or TX commands. The fix separates beacon rate handling and restores the correct rate index return values for the TX_CMD. The vulnerability is reachable via the wireless network interface and affects system availability.
Affected products
- Linux Linux Kernel 6.18.34, 7.0.11, 7.1
Timeline
- 2026-05-15: other: Patch authored by Johannes Berg
- 2026-06-01: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published