All vulnerabilities
CVE-2026-93796

Linux: wifi: iwlwifi: pcie: null RX pointers after free

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6ec5bf430cf7466cb412e47f2761594092781facAlso 3456c5bcc987aeb182e50e30c9b02be8420e9953, 2c79d7a7b583050c9f58041465cb46fe3483ab5dCVE List
Published24 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 6ec5bf430cf7466cb412e47f2761594092781facLinuxCVE List
  • 3456c5bcc987aeb182e50e30c9b02be8420e9953LinuxCVE List
  • 2c79d7a7b583050c9f58041465cb46fe3483ab5dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: pcie: null RX pointers after free

When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free().

The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to make repeated cleanup and retry paths safe.

Text from CVE List

Affected versions 10

  • Linuxaffected: 9cf671d60fdbeb8f875859c11148cf13c326ada2 before c422d5d53f135ea987f745773953a91f9fe30c3fCVE List
  • Linuxaffected: 9cf671d60fdbeb8f875859c11148cf13c326ada2 before 6ec5bf430cf7466cb412e47f2761594092781facCVE List
  • Linuxaffected: 9cf671d60fdbeb8f875859c11148cf13c326ada2 before 3456c5bcc987aeb182e50e30c9b02be8420e9953CVE List
  • Linuxaffected: 9cf671d60fdbeb8f875859c11148cf13c326ada2 before 2c79d7a7b583050c9f58041465cb46fe3483ab5dCVE List
  • Linuxaffected: 5.12CVE List
  • Linuxunaffected: all versions before 5.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4