{"id":"CVE-2026-98426","state":"PUBLISHED","title":"wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path\n\nmwifiex_pcie_request_irq() registers each MSI-X vector with a per-index\ndev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop\n\"for (j = 0; j < i; j++)\" frees msix_entries[j].vector but passes the\nfailed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on\n(irq, dev_id), so it fails to find the action registered with\n&card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and\nfree_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].","publishedAt":"2026-10-14T13:27:53.177Z","updatedAt":"2026-10-19T09:19:20.215Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"1a60cb2292194cc9eafae7ca8a8a72d37ae78d97","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"fcac5813f324cd07dfd36b4adf624fc70f7587d6","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"2761b21cb896b1da8dd46cee5084c9032b2d7098","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"5fd4cc87e6cc0839aac89c24ebe39ce262fe088f","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"0969c9688389f2e0f65b1a924b0dd6625a3bb776","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"03d5e4776e8b71c2468c5c3c48b39202c87a8796","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"a3d722190cdef18da4878b5efc27c3c386dda248","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/marvell/mwifiex/pcie.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.6","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.54","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.8","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/marvell/mwifiex/pcie.c"]}],"references":["https://git.kernel.org/stable/c/11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd","https://git.kernel.org/stable/c/1a60cb2292194cc9eafae7ca8a8a72d37ae78d97","https://git.kernel.org/stable/c/fcac5813f324cd07dfd36b4adf624fc70f7587d6","https://git.kernel.org/stable/c/2761b21cb896b1da8dd46cee5084c9032b2d7098","https://git.kernel.org/stable/c/5fd4cc87e6cc0839aac89c24ebe39ce262fe088f","https://git.kernel.org/stable/c/0969c9688389f2e0f65b1a924b0dd6625a3bb776","https://git.kernel.org/stable/c/03d5e4776e8b71c2468c5c3c48b39202c87a8796","https://git.kernel.org/stable/c/a3d722190cdef18da4878b5efc27c3c386dda248"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98426.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98426","state":"PUBLISHED","datePublished":"2026-10-14T13:27:53.177Z","dateUpdated":"2026-10-19T09:19:20.215Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.348Z"},"containers":{"cna":{"title":"wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path\n\nmwifiex_pcie_request_irq() registers each MSI-X vector with a per-index\ndev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop\n\"for (j = 0; j < i; j++)\" frees msix_entries[j].vector but passes the\nfailed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on\n(irq, dev_id), so it fails to find the action registered with\n&card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and\nfree_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j]."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"1a60cb2292194cc9eafae7ca8a8a72d37ae78d97","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"fcac5813f324cd07dfd36b4adf624fc70f7587d6","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"2761b21cb896b1da8dd46cee5084c9032b2d7098","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"5fd4cc87e6cc0839aac89c24ebe39ce262fe088f","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"0969c9688389f2e0f65b1a924b0dd6625a3bb776","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"03d5e4776e8b71c2468c5c3c48b39202c87a8796","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","status":"affected","lessThan":"a3d722190cdef18da4878b5efc27c3c386dda248","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/marvell/mwifiex/pcie.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.6","versionType":"semver"},{"version":"5.10.271","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.222","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.54","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.8","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/marvell/mwifiex/pcie.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd"},{"url":"https://git.kernel.org/stable/c/1a60cb2292194cc9eafae7ca8a8a72d37ae78d97"},{"url":"https://git.kernel.org/stable/c/fcac5813f324cd07dfd36b4adf624fc70f7587d6"},{"url":"https://git.kernel.org/stable/c/2761b21cb896b1da8dd46cee5084c9032b2d7098"},{"url":"https://git.kernel.org/stable/c/5fd4cc87e6cc0839aac89c24ebe39ce262fe088f"},{"url":"https://git.kernel.org/stable/c/0969c9688389f2e0f65b1a924b0dd6625a3bb776"},{"url":"https://git.kernel.org/stable/c/03d5e4776e8b71c2468c5c3c48b39202c87a8796"},{"url":"https://git.kernel.org/stable/c/a3d722190cdef18da4878b5efc27c3c386dda248"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T09:19:20.215Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"5.10.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"5.15.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.18.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"7.2.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}