Cloudanix VulnDB

CVE-2026-98426

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small mistake in the WiFi driver's error cleanup code could leave system resources allocated when something goes wrong during startup, potentially causing instability on certain hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect index passed to free_irq() in mwifiex_pcie_request_irq() error path causes registered MSI-X IRQs to remain allocated instead of being released, producing kernel warnings and resource leaks.

Why it matters to the business

Driver initialization failures on affected WiFi hardware can leave kernel resources allocated, increasing risk of system instability or unexpected warnings in production Linux environments.

How an attack unfolds

No attacker-controlled exploitation path exists; this is an internal error-handling defect in the driver that surfaces only when request_irq() fails during device probe.

How to fix it

Update to a Linux kernel containing the fix for the incorrect index in the MSI-X error cleanup loop.

How to confirm the fix worked

Confirm the corrected loop passes &card->msix_ctx[j] rather than &card->msix_ctx[i] to free_irq() and verify absence of the associated warning on probe failure.

Typical attack path

  1. Trigger mwifiex PCIe device initialization
  2. Cause request_irq() to fail for one MSI-X vector
  3. Observe that prior vectors are not released due to mismatched dev_id
  4. Kernel logs warning about freeing non-existent IRQ

How to detect it

Search kernel logs for mwifiex free_irq warnings mentioning non-existent IRQ or mismatched dev_id during PCIe probe; inspect driver source for the original buggy loop index.

What your security team should do

  • Apply the kernel update containing the corrected error path as soon as it is available for your distribution
  • Monitor kernel logs for mwifiex IRQ-related warnings during driver load on affected hardware

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the failed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on (irq, dev_id), so it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].

Affected packages

Ecosystem Package Introduced Fixed