CVE-2026-64176High· 8.1▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM ra…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
0.2% → 0.3%
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.)
While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2, to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the code in iwl_mvm_mac80211_idx_to_hwrate() to no longer have different values for different APIs. This was correct.
However, I later reverted this part of the change, because it was reported that I had broken beacon rates, causing a FW assert/crash. This caused TX_CMD rates to be set incorrectly, potentially causing a warning when reported back from the device as having been used.
Fix this (hopefully correctly now) by handling beacon rates in the TX_CMD that's embedded in the beacon template command separately. Restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index, not PLCP value, fixing the real TX_CMD.
Linux >= 3592c0083fb29cca13cd9978b8844d58b4eff548 < 6fe92651b44fd3cfc8dcfdaad0e82885c384dadaLinux >= 3592c0083fb29cca13cd9978b8844d58b4eff548 < 6b58a79f2cd98156856eb49e8b55db5facdd7e6dLinux >= 3592c0083fb29cca13cd9978b8844d58b4eff548 < fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483bLinux c6c14c2b08e9c4c82e1ec39ef3e8b9ec845ac7fdLinux >= 6.17.9 < 6.18Linux 6.18Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99100Nonewifi: p54: validate firmware record lengths
CVE-2024-38564High· 7.8bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr