CVE-2026-64037

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled

When the TLC notification disables AMSDU for a TID, the MLD driver sets maxtidamsdulen to the sentinel value 1. The TSO segmentation path in iwlmldtxtsosegment() checks for zero but not for this sentinel, allowing it to reach the numsubframes calculation:

numsubframes = (maxtidamsdulen + pad) / (subf_len + pad) = (1 + 2) / (1534 + 2) = 0

This zero propagates to iwltxtso_segment() which sets:

gsosize = numsubframes * mss = 0

Calling skbgsosegment() with gsosize=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcpshiftedskb, NULL deref in tcprackdetectloss).

The MVM driver is immune because it checks mvmsta->amsduenabled before reaching the numsubframes calculation. The MLD driver has no equivalent bitmap check and relies solely on maxtidamsdu_len, which does not catch the sentinel value.

Fix this by detecting the sentinel value (maxtidamsdulen == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARNONONCE guard after the numsubframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism.