CVE-2026-64037

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iwlwifi driver within the MLD (Multi-Link Device) component. When AMSDU (Aggregate MAC Service Data Unit) is disabled for a Traffic Identifier (TID), the driver sets the max tid amsdu len variable to a sentinel value of 1. The TSO (TCP Segmentation Offload) segmentation path in the iwl mld tx tso segment() function fails to check for this sentinel value, resulting in a num subframes calculation of zero. This value propagates to iwl tx tso segment(), setting gso size to 0. Consequently, calling skb gso segment() with a gso size of 0 generates over 32,000 small segments from a single GSO socket buffer (skb). This floods the TX ring with approximately 1,024 micro-frames, causing a massive burst of TX completion events. This sequence can lead to memory corruption and a subsequent use-after-free in the TCP retransmit queue, specifically causing a refcount underflow in tcp shifted skb() and a NULL dereference in tcp rack detect loss().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.