CVE-2026-98426
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irq() regist…
Published Oct 14, 2026
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j msix_ctx[i] as the dev_id. free_irq() matches on (irq, dev_id), so it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · Tenable CVE Database
Detected
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j msix_ctx[i] as the dev_id. free_irq() matches on (irq, dev_id), so it fails to find the action registered
Sources
- CVE.orgCVE-2026-98426
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-98426
30-day exploitation probability 0.2%
first.org - Tenable CVE DatabaseCVE-2026-98426
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j msix_ctx[i] as the dev_id. free_irq() matches on (irq, dev_id), so it fails to find the action registered
tenable.com