CVE-2026-64176

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix driver-set TX rates on old devices

On old devices such as 7265D, rates are still encoded in version 1

format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but

rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.)

While introducing v3 rates, I changed the driver from internally

handling v1 rates and converting to v2, to internally handling v3

and converting to v1 or v2 according to the firmware. I accordingly

changed the code in iwl_mvm_mac80211_idx_to_hwrate() to no longer

have different values for different APIs. This was correct.

However, I later reverted this part of the change, because it was

reported that I had broken beacon rates, causing a FW assert/crash.

This caused TX_CMD rates to be set incorrectly, potentially causing

a warning when reported back from the device as having been used.

Fix this (hopefully correctly now) by handling beacon rates in the

TX_CMD that's embedded

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References