https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 07:04:06 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64255 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers</p> <p>Three BA session handlers use ffs(ba_data-&gt;sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[].</p> <p>Add WARN_ON_ONCE(!ba_data-&gt;sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers</p> <p>Three BA session handlers use ffs(ba_data-&gt;sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[].</p> <p>Add WARN_ON_ONCE(!ba_data-&gt;sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start().</p> https://vulnerability.circl.lu/vuln/cve-2026-64255