VYPR
← All advisories
High severity8.8NVD Advisory· Published Jul 24, 2026· Updated Oct 19, 2026

CVE-2026-64255

CVE-2026-64255

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[].

Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

79

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.