Linux Kernel iwlwifi Driver Firmware Restart Transmission Issue Causes Denial-of-Service

A denial-of-service vulnerability has been identified in the Linux kernel's iwlwifi Wi-Fi driver, specifically in the MLD (Multi-Link Device) handling. This issue arises when the iwlwifi firmware crashes, such as during NMI_INTERRUPT_UNKNOWN events on Intel BE201 chipsets with Wi-Fi 7. The crash triggers a flag indicating that the firmware is restarting, but the driver fails to pause transmission before dequeuing frames from the mac80211 layer. As a result, the driver attempts to send these frames while the firmware is unresponsive, leading to a loop where failed transmission attempts are quickly freed, causing excessive CPU usage and memory fragmentation. This problem has been observed under heavy network conditions, such as with Tailscale UDP traffic or active SSH sessions, and has been tested on an ASUS Zenbook 14 UX3405CA.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, where the system's CPU resources are consumed unnecessarily, and memory management is disrupted due to fragmented slab allocations.

Reproduction

The vulnerability can be reproduced on a device with an Intel BE201 Wi-Fi 7 chipset running Linux kernel 6.19.5. Under normal conditions, the iwlwifi firmware crashes approximately every 10-15 minutes when Tailscale traffic is active. During these crashes, the driver does not halt transmission, causing a rapid cycle of dequeuing and freeing frames, which wastes CPU cycles and creates memory pressure from slab fragmentation.

Remediation

Users can upgrade to the patched version of the Linux kernel where this issue has been addressed. The patch is available in the Linux stable repository.