PT-2026-61354 · Linux · Linux
CVE-2026-64037
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
When the TLC notification disables AMSDU for a TID, the MLD driver sets
max tid amsdu len to the sentinel value 1. The TSO segmentation path in
iwl mld tx tso segment() checks for zero but not for this sentinel,
allowing it to reach the num subframes calculation:
num subframes = (max tid amsdu len + pad) / (subf len + pad)
= (1 + 2) / (1534 + 2) = 0
This zero propagates to iwl tx tso segment() which sets:
gso size = num subframes * mss = 0
Calling skb gso segment() with gso size=0 creates over 32000 tiny
segments from a single GSO skb. This floods the TX ring with ~1024
micro-frames (the rest are purged), creating a massive burst of TX
completion events that can lead to memory corruption and a subsequent
use-after-free in TCP's retransmit queue (refcount underflow in
tcp shifted skb, NULL deref in tcp rack detect loss).
The MVM driver is immune because it checks mvmsta->amsdu enabled before
reaching the num subframes calculation. The MLD driver has no equivalent
bitmap check and relies solely on max tid amsdu len, which does not
catch the sentinel value.
Fix this by detecting the sentinel value (max tid amsdu len == 1) at the
existing check and falling back to non-AMSDU TSO segmentation. Also add
a WARN ON ONCE guard after the num subframes division as defense-in-depth
to catch any future code paths that produce zero through a different
mechanism.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux