All vulnerabilities
CVE-2026-98426

Linux: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11bc2cbb14f450eaa47cce9eb086f948ef8f4bcdAlso 1a60cb2292194cc9eafae7ca8a8a72d37ae78d97, 2761b21cb896b1da8dd46cee5084c9032b2d7098 and 3 moreCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 11bc2cbb14f450eaa47cce9eb086f948ef8f4bcdLinuxCVE List
  • 1a60cb2292194cc9eafae7ca8a8a72d37ae78d97LinuxCVE List
  • 2761b21cb896b1da8dd46cee5084c9032b2d7098LinuxCVE List
  • 5fd4cc87e6cc0839aac89c24ebe39ce262fe088fLinuxCVE List
  • 0969c9688389f2e0f65b1a924b0dd6625a3bb776LinuxCVE List
  • 03d5e4776e8b71c2468c5c3c48b39202c87a8796LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path

mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the failed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on (irq, dev_id), so it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].

Text from CVE List

Affected versions 18

  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before 11bc2cbb14f450eaa47cce9eb086f948ef8f4bcdCVE List
  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before 1a60cb2292194cc9eafae7ca8a8a72d37ae78d97CVE List
  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before fcac5813f324cd07dfd36b4adf624fc70f7587d6CVE List
  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before 2761b21cb896b1da8dd46cee5084c9032b2d7098CVE List
  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before 5fd4cc87e6cc0839aac89c24ebe39ce262fe088fCVE List
  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before 0969c9688389f2e0f65b1a924b0dd6625a3bb776CVE List
  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before 03d5e4776e8b71c2468c5c3c48b39202c87a8796CVE List
  • Linuxaffected: 99074fc1e67b374b5c72406a23ac01fed806d634 before a3d722190cdef18da4878b5efc27c3c386dda248CVE List
  • Linuxaffected: 4.6CVE List
  • Linuxunaffected: all versions before 4.6CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8