CVE-2026-98426wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the failed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on (irq, dev_id), so it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
Linux Linux linux:linux (from the name) | 99074fc1e67b374b5c72406a23ac01fed806d634 builds before 11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd; 99074fc1e67b374b5c72406a23ac01fed806d634 builds before 1a60cb2292194cc9eafae7ca8a8a72d37ae78d97; from 99074fc1e67b374b5c72406a23ac01fed806d634 before fcac5813f324cd07dfd36b4adf624fc70f7587d6; 99074fc1e67b374b5c72406a23ac01fed806d634 builds before 2761b21cb896b1da8dd46cee5084c9032b2d7098; 99074fc1e67b374b5c72406a23ac01fed806d634 builds before 5fd4cc87e6cc0839aac89c24ebe39ce262fe088f; 99074fc1e67b374b5c72406a23ac01fed806d634 builds before 0969c9688389f2e0f65b1a924b0dd6625a3bb776; 99074fc1e67b374b5c72406a23ac01fed806d634 builds before 03d5e4776e8b71c2468c5c3c48b39202c87a8796; from 99074fc1e67b374b5c72406a23ac01fed806d634 before a3d722190cdef18da4878b5efc27c3c386dda248 | CNA record |
References
- https://git.kernel.org/stable/c/11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd
- https://git.kernel.org/stable/c/1a60cb2292194cc9eafae7ca8a8a72d37ae78d97
- https://git.kernel.org/stable/c/fcac5813f324cd07dfd36b4adf624fc70f7587d6
- https://git.kernel.org/stable/c/2761b21cb896b1da8dd46cee5084c9032b2d7098
- https://git.kernel.org/stable/c/5fd4cc87e6cc0839aac89c24ebe39ce262fe088f
- https://git.kernel.org/stable/c/0969c9688389f2e0f65b1a924b0dd6625a3bb776
- https://git.kernel.org/stable/c/03d5e4776e8b71c2468c5c3c48b39202c87a8796
- https://git.kernel.org/stable/c/a3d722190cdef18da4878b5efc27c3c386dda248
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.