In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: iwlwifi: mld: stop TX during firmware restart<\/p>\n
When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel
\nBE201\/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart
\nto true. However, iwl_mld_tx_from_txq() does not check this flag before
\ndequeuing frames from mac80211 and pushing them to the transport layer.<\/p>\n
Since the firmware is dead, iwl_trans_tx() returns -EIO for each frame,
\nwhich then gets freed immediately. Under high-throughput conditions
\n(e.g., Tailscale UDP traffic or active SSH sessions), this creates a
\ntight dequeue-send-fail-free loop that wastes CPU cycles and generates
\nrapid skb allocation churn, leading to memory pressure from slab
\nfragmentation.<\/p>\n
The RX path already has this guard (iwl_mld_rx_mpdu checks
\nin_hw_restart at rx.c:1906), and so does the TXQ allocation worker
\n(iwl_mld_add_txqs_wk at tx.c:156). Add the same guard to
\niwl_mld_tx_from_txq() to stop all TX during firmware restart.<\/p>\n
Frames left in mac80211’s TXQs are naturally drained after restart
\ncompletes, when queue reallocation triggers iwl_mld_tx_from_txq()
\nvia iwl_mld_add_txq_list(), or when new upper-layer traffic invokes
\nwake_tx_queue.<\/p>\n
Tested on ASUS Zenbook 14 UX3405CA with Intel BE201 (Wi-Fi 7) on
\nkernel 6.19.5 where the firmware crashes approximately every 10-15
\nminutes under Tailscale traffic.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: iwlwifi: mld: stop TX during firmware restart<\/p>\n
When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel
\nBE201\/Wi-F<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15112","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}