CVE-2026-64037

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled

When the TLC notification disables AMSDU for a TID, the MLD driver sets

maxtidamsdu_len to the sentinel value 1. The TSO segmentation path in

iwlmldtxtsosegment() checks for zero but not for this sentinel,

allowing it to reach the num_subframes calculation:

  numsubframes = (maxtidamsdulen + pad) / (subf_len + pad)

                = (1 + 2) / (1534 + 2) = 0

This zero propagates to iwltxtso_segment() which sets:

  gsosize = numsubframes * mss = 0

Calling skbgsosegment() with gso_size=0 creates over 32000 tiny

segments from a single GSO skb. This floods the TX ring with ~1024

micro-frames (the rest are purged), creating a massive burst of TX

completion events that can lead to memory corruption and a subsequent

use-after-free in TCP's retransmit queue (refcount underflow in

tcpshiftedskb, NULL deref in tcprackdetect_loss).

The MVM driver is immune because it checks mvmsta->amsdu_enabled before

reaching the num_subframes calculation. The MLD driver has no equivalent

bitmap check and relies solely on maxtidamsdu_len, which does not

catch the sentinel value.

Fix this by detecting the sentinel value (maxtidamsdu_len == 1) at the

existing check and falling back to non-AMSDU TSO segmentation. Also add

a WARNONONCE guard after the num_subframes division as defense-in-depth

to catch any future code paths that produce zero through a different

mechanism.