{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98426","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.348Z","datePublished":"2026-10-14T13:27:53.177Z","dateUpdated":"2026-10-19T09:19:20.215Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-19T09:19:20.215Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path\n\nmwifiex_pcie_request_irq() registers each MSI-X vector with a per-index\ndev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop\n\"for (j = 0; j < i; j++)\" frees msix_entries[j].vector but passes the\nfailed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on\n(irq, dev_id), so it fails to find the action registered with\n&card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and\nfree_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j]."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/marvell/mwifiex/pcie.c"],"versions":[{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd","status":"affected","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"1a60cb2292194cc9eafae7ca8a8a72d37ae78d97","status":"affected","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"fcac5813f324cd07dfd36b4adf624fc70f7587d6","status":"affected","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"2761b21cb896b1da8dd46cee5084c9032b2d7098","status":"affected","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"5fd4cc87e6cc0839aac89c24ebe39ce262fe088f","status":"affected","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"0969c9688389f2e0f65b1a924b0dd6625a3bb776","status":"affected","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"03d5e4776e8b71c2468c5c3c48b39202c87a8796","status":"affected","versionType":"git"},{"version":"99074fc1e67b374b5c72406a23ac01fed806d634","lessThan":"a3d722190cdef18da4878b5efc27c3c386dda248","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/marvell/mwifiex/pcie.c"],"versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"5.10.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"5.15.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"6.18.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"7.2.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.6","versionEndExcluding":"7.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd"},{"url":"https://git.kernel.org/stable/c/1a60cb2292194cc9eafae7ca8a8a72d37ae78d97"},{"url":"https://git.kernel.org/stable/c/fcac5813f324cd07dfd36b4adf624fc70f7587d6"},{"url":"https://git.kernel.org/stable/c/2761b21cb896b1da8dd46cee5084c9032b2d7098"},{"url":"https://git.kernel.org/stable/c/5fd4cc87e6cc0839aac89c24ebe39ce262fe088f"},{"url":"https://git.kernel.org/stable/c/0969c9688389f2e0f65b1a924b0dd6625a3bb776"},{"url":"https://git.kernel.org/stable/c/03d5e4776e8b71c2468c5c3c48b39202c87a8796"},{"url":"https://git.kernel.org/stable/c/a3d722190cdef18da4878b5efc27c3c386dda248"}],"title":"wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path","x_generator":{"engine":"bippy-1.2.0"}}}}