Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[]. Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-64255 Linux Kernel WiFi iwlwifi MLD Out-of-Bounds Access via Unvalidated sta_mask https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64255
Post summary
The post provides a basic disclosure of a Linux kernel WiFi driver flaw, detailing its nature but offering no PoC, exploit, or mitigation information.
CVE-2026-64255 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handl… https://www.cve.org/CVERecord?id=CVE-2026-64255
Post summary
CVE‑2026‑64255, a Linux kernel iwlwifi issue involving validation of sta_mask before ffs() in BA session handlers, has been fixed by a patch. No evidence of exploitation or PoC is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |