CVE-2026-93796

wifi: iwlwifi: pcie: null RX pointers after free

State: Published
Severity: 7.0 High
Published: Sep 24, 2026
Updated: Oct 30, 2026
Reserved: Sep 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: pcie: null RX pointers after free

When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free().

The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to make repeated cleanup and retry paths safe.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 847103369489110a222482c7781e0fe62cdbd3d5Affected 9cf671d60fdbeb8f875859c11148cf13c326ada2 to before c422d5d53f135ea987f745773953a91f9fe30c3fAffected 9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 6ec5bf430cf7466cb412e47f2761594092781facAffected 9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 3456c5bcc987aeb182e50e30c9b02be8420e9953Affected 9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 2c79d7a7b583050c9f58041465cb46fe3483ab5dAffected
LinuxLinux	5.12Affected before 5.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 847103369489110a222482c7781e0fe62cdbd3d5Affected
9cf671d60fdbeb8f875859c11148cf13c326ada2 to before c422d5d53f135ea987f745773953a91f9fe30c3fAffected
9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 6ec5bf430cf7466cb412e47f2761594092781facAffected
9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 3456c5bcc987aeb182e50e30c9b02be8420e9953Affected
9cf671d60fdbeb8f875859c11148cf13c326ada2 to before 2c79d7a7b583050c9f58041465cb46fe3483ab5dAffected

LinuxLinux

5.12Affected
before 5.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.