Linux: Incorrect Calculation
CVE-2026-64176 is a high-severity incorrect calculation vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 6fe92651b44fd3cfc8dcfdaad0e82885c384dada, 6b58a79f2cd98156856eb49e8b55db5facdd7e6d, fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.27% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 6fe92651b44fd3cfc8dcfdaad0e82885c384dada or 6b58a79f2cd98156856eb49e8b55db5facdd7e6d or fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b or 6.18, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.18 or 6.18.34 or 7.0.11, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 3592c0083fb29cca13cd9978b8844d58b4eff548 up to, but not including, 6fe92651b44fd3cfc8dcfdaad0e82885c384dada; 3592c0083fb29cca13cd9978b8844d58b4eff548 up to, but not including, 6b58a79f2cd98156856eb49e8b55db5facdd7e6d; 3592c0083fb29cca13cd9978b8844d58b4eff548 up to, but not including, fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b; c6c14c2b08e9c4c82e1ec39ef3e8b9ec845ac7fd; 6.17.9 up to, but not including, 6.18; 6.18 | 6fe92651b44fd3cfc8dcfdaad0e82885c384dada, 6b58a79f2cd98156856eb49e8b55db5facdd7e6d, fb84b5cbcaab3ca0f4e961d92a40ed7f3aac483b, 6.18 |
| Linux | Linux Kernel | 6.17.9 up to, but not including, 6.18; 6.18.1 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 6.18; 7.1 | 6.18, 6.18.34, 7.0.11 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.) While introducing v3 rates, I changed the driver from internally handling v1 rates and converting to v2, to internally handling v3 and converting to v1 or v2 according to the firmware. I accordingly changed the code in iwl_mvm_mac80211_idx_to_hwrate() to no longer have different values for different APIs. This was correct. However, I later reverted this part of the change, because it was reported that I had broken beacon rates, causing a FW assert/crash. This caused TX_CMD rates to be set incorrectly, potentially causing a warning when reported back from the device as having been used. Fix this (hopefully correctly now) by handling beacon rates in the TX_CMD that's embedded in the beacon template command separately. Restore iwl_mvm_mac80211_idx_to_hwrate() to return only the rate index, not PLCP value, fixing the real TX_CMD.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
How developers prevent this class of flaw
- Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, not-a-number calculations, and how your language handles numbers that are too large or too small for its underlying representation.
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Incorrect Calculation vulnerabilities
- 7.5 High severity
- 8.6 High severity
- 7.8 High severity
- 8.3 High severity
- 9.1 Critical severity
- 9.8 Critical severity
Spotted an error? Tell us.