CVE-2026-64255

The CVE affects the Linux kernel WiFi stack (iwlwifi/mld). Three BA session handlers call ffs(ba_data->sta_mask) - 1 to derive a station ID without ensuring sta_mask is non-zero. If sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw...