CVE-2026-64255

The CVE affects the Linux kernel WiFi stack (iwlwifi/mld). Three BA session handlers call ffs(ba_data->sta_mask) - 1 to derive a station ID without ensuring sta_mask is non-zero. If sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw...

PT-2026-64370

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta mask before ffs in BA session handlers Three BA session handlers use ffsba data-sta mask - 1 to derive a station ID without checking that sta mask is non-zero. When sta mask is zero, ffs returns 0...