Cloudanix VulnDB

CVE-2026-98191

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small error-handling mistake in the Linux WiFi driver can stop some wireless cards from managing power properly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The wlcore_regdomain_config function fails to release a runtime PM reference acquired via pm_runtime_resume_and_get when wlcore_cmd_regdomain_config_locked returns an error, leaving an unbalanced reference count that can prevent device suspension or trigger repeated recovery attempts.

Why it matters to the business

WiFi interfaces on affected Linux systems may experience instability, elevated power usage, or repeated driver recovery, disrupting connectivity for users and embedded devices until the kernel is updated.

How an attack unfolds

An attacker would need to induce a failure in the regulatory-domain command path inside wlcore, which is not readily controllable from remote network positions; the low EPSS score and absence from KEV indicate no practical exploitation path has been observed.

How to fix it

Apply the upstream kernel commit that balances the pm_runtime reference on both success and failure paths in wlcore_regdomain_config; monitor distribution backports for the wlcore driver.

How to confirm the fix worked

Inspect the wlcore source for paired pm_runtime_resume_and_get and pm_runtime_put calls around regdomain handling, and confirm the error path releases the reference before queuing recovery.

Typical attack path

  1. Cause wlcore_cmd_regdomain_config_locked to fail
  2. Observe the missing pm_runtime_put in the error path
  3. Trigger repeated recovery worker invocations due to leaked reference

How to detect it

Search kernel logs and dmesg for wlcore recovery worker messages, unbalanced runtime PM warnings, or repeated regdomain command failures; correlate with device suspend attempts.

What your security team should do

  • Prioritize kernel updates containing the wlcore reference-count fix
  • Test WiFi suspend/resume behavior on affected hardware after patching
  • Review kernel logs for wlcore recovery messages during routine operations

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcore_regdomain_config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore_cmd_regdomain_config_locked() fails, the function queues recovery and returns without dropping that reference. Release the reference after handling the command result so both success and failure paths balance the preceding pm_runtime_resume_and_get(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.

Affected packages

Ecosystem Package Introduced Fixed