Out-of-Bounds Access Vulnerability in Linux Kernel's Iwlwifi Product

CVE-2026-64255

What is CVE-2026-64255?

In the Linux Kernel's Iwlwifi component, an essential vulnerability has been identified related to the validation of the station mask in block acknowledgment session handlers. Specifically, when the 'sta_mask' is found to be zero, the 'ffs()' function produces a value that, when subtracted by one, wraps around to a large positive integer due to integer underflow. This incorrect handling may result in out-of-bounds access on the 'fw_id_to_link_sta[]' array. The issue has been mitigated by implementing warning checks before each invocation of 'ffs()' to ensure that 'sta_mask' is not zero, thus preventing potential exploitation and maintaining the integrity of data handling in wireless networking.

References