Skip to main content

Linux Kernel CVE-2026-64176

| EUVDEUVD-2026-45861 HIGH
2026-07-19 Linux GHSA-m7pm-g64q-7xf7
Denial Of Service Linux
High
Disputed · 8.1 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
3.1 LOW

Impact is a beacon-mode firmware assert on specific old hardware (A:L), no confidentiality/integrity effect, and the condition is hard to attacker-trigger reliably (AC:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:48 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.1 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:41 cve.org
HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.)

While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2, to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the code in iwl_mvm_mac80211_idx_to_hwrate() to no longer have different values for different APIs. This was correct.

However, I later reverted this part of the change, because it was reported that I had broken beacon rates, causing a FW assert/crash. This caused TX_CMD rates to be set incorrectly, potentially causing a warning when reported back from the device as having been used.

Fix this (hopefully correctly now) by handling beacon rates in the TX_CMD that's embedded in the beacon template command separately. Restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index, not PLCP value, fixing the real TX_CMD.

AnalysisAI

Denial-of-service in the Linux kernel iwlwifi mvm WiFi driver affects older Intel wireless adapters such as the 7265D, where a regression in TX-rate encoding sets TX_CMD rates incorrectly. When the device reports these malformed rates back, the driver can emit warnings and, for beacon rates, trigger a firmware assert/crash that disrupts wireless connectivity. This is a fixed regression with no public exploit identified at time of analysis and a low EPSS score (0.15%), indicating negligible real-world exploitation interest.

Technical ContextAI

The issue lives in Intel's iwlwifi mvm driver, specifically iwl_mvm_mac80211_idx_to_hwrate(), which translates mac80211 rate indices into hardware rate values. Older devices (e.g. 7265D) still use version 1 rate encoding based on PLCP values (e.g. 10 for 1 Mbps CCK) rather than the newer CCK/OFDM rate-index scheme (0-3 / 0-7). During the introduction of v3 rate handling the driver was refactored to internally handle v3 and convert down to v1/v2, but a partial revert (made to avoid breaking beacon rates) left TX_CMD rates encoded inconsistently. No CWE is assigned; functionally this is an incorrect data-conversion / API-versioning regression in kernel WiFi rate control affecting the beacon template TX_CMD path.

RemediationAI

Vendor-released patch: update to Linux kernel 6.18.34, 7.0.11, or 7.1 (or later), which contain the corrected beacon-rate handling and restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index. The upstream fixes are commits https://git.kernel.org/stable/c/6fe92651b44fd3cfc8dcfdaad0e82885c384dada, https://git.kernel.org/stable/c/6b58a79f2cd98156856eb49e8b55db5facdd7e6d, and https://git.kernel.org/stable/c/fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b; consume the fix through your distribution's stable-kernel updates. As a compensating control on affected hosts you can avoid running the impacted old Intel adapters in AP/beacon-transmitting mode (which is where the beacon FW assert manifests), at the cost of losing hotspot/AP functionality on that hardware; otherwise no special mitigation beyond patching is warranted given the low severity.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64176 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy