---
id: CVE-2026-64212
title: 'wifi: iwlwifi: mld: don''t dereference a pointer before NULL checking it'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it

  In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the
  function so we have it…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3a74aaad047353da3344aed32e9042d4f334f926
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d733ed481fd20a8e7bfe5119c4e77761ba3f87ee
  - Linux < 6.18.34
  - Linux < 7.0.11
  - Linux (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:32:12.324208Z'
published: '2026-07-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:29.913Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64212'
references:
  - url: 'https://git.kernel.org/stable/c/3a74aaad047353da3344aed32e9042d4f334f926'
  - url: 'https://git.kernel.org/stable/c/b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0'
  - url: 'https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee'
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04706
ingestedAt: '2026-11-06T16:57:43.222Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it

In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the
function so we have it after we freed the link.

But the link pointer can be NULL, and is not checked when the fw_id is
stored.

Fix it by simply freeing the link at the end of the function.

fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()")

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3a74aaad047353da3344aed32e9042d4f334f926`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d733ed481fd20a8e7bfe5119c4e77761ba3f87ee`
- `Linux < 6.18.34`
- `Linux < 7.0.11`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.