Linux Kernel CVE-2026-64212

Exploitation requires: (1) local authenticated access to the target system (PR:L per CVSS), (2) the target system must have Intel wireless hardware supported by the iwlwifi driver with MLD (Multi-Link Device / Wi-Fi 7 Multi-Link Operation) functionality, and (3) the attacker must be able to trigger the iwl_mld_remove_link code path under conditions where the link pointer is NULL - most likely arising from a specific error condition or race during Wi-Fi interface teardown. Systems without Intel MLD-capable Wi-Fi hardware are not affected. The vulnerability does not affect systems running only wired networking or non-Intel Wi-Fi adapters. No remote attack vector exists; network access alone is insufficient.

Real-world risk is moderate-to-low. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly reflects local exploitation requiring only standard user-level privileges with no special attack complexity - any local user on an affected system with Intel MLD-capable Wi-Fi hardware could potentially trigger the crash. However, the impact is confined to availability; there is no confidentiality or integrity exposure. The EPSS score of 0.17% at the 6th percentile strongly supports treating this as a low-exploitation-likelihood vulnerability - even a mid-sized municipal IT team in legnica should treat routine patching as sufficient response rather than emergency remediation. The vulnerability is not in CISA KEV and no public exploit code has been identified, consistent with the EPSS signal. SSVC signals suggest: exploitation is unlikely, automation is theoretically possible for local attackers but requires hardware presence, and technical impact is partial (DoS only). The primary real-world risk is accidental trigger or opportunistic local privilege misuse on desktop or laptop Linux systems with Intel Wi-Fi 7 hardware.

A local user on a Linux system equipped with an Intel Wi-Fi 7 adapter loads or interacts with the iwlwifi MLD driver in a manner that causes iwl_mld_remove_link to be called with a NULL link pointer - for example, through abnormal Wi-Fi interface teardown or error conditions during driver operation. The function dereferences link->fw_id before checking for NULL, triggering a kernel NULL pointer dereference, causing an immediate kernel panic and system reboot. No public proof-of-concept has been identified, and triggering the specific NULL condition likely requires knowledge of driver internals or specific hardware state.