CVE-2026-64176

wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

HIGH
8.1
CVSS Score
Published: July 19, 2026 at 03:41 PM UTC
Updated: October 19, 2026 at 09:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.) While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2, to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the code in iwl_mvm_mac80211_idx_to_hwrate() to no longer have different values for different APIs. This was correct. However, I later reverted this part of the change, because it was reported that I had broken beacon rates, causing a FW assert/crash. This caused TX_CMD rates to be set incorrectly, potentially causing a warning when reported back from the device as having been used. Fix this (hopefully correctly now) by handling beacon rates in the TX_CMD that's embedded in the beacon template command separately. Restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index, not PLCP value, fixing the real TX_CMD.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.17.9 ≤ v < 6.186.18.1 ≤ v < 6.18.346.19 ≤ v < 7.0.113592c0083fb29cca13cd9978b8844d58b4eff5486.17.96.186.18 rc66.18 rc77.17.1 rc17.1 rc27.1 rc37.1 rc4c6c14c2b08e9c4c82e1ec39ef3e8b9ec845ac7fd
Vendor states this is fixed in 6b58a79f2cd98156856eb49e8b55db5facdd7e6d (fixed)
Vendor states this is fixed in 6fe92651b44fd3cfc8dcfdaad0e82885c384dada (fixed)
Vendor states this is fixed in fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b (fixed)
Vendor states this is fixed in 6.18 (unaffected)
Vendor states this is fixed in 6.18.34 (unaffected)
Vendor states this is fixed in 7.0.11 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.1HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfoCWE-682

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card