Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-98426
Published: October 15, 2026
Vulnerability identifier: #VU155884
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98426
CWE-ID: CWE-772
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to leak interrupt resources.
The vulnerability exists due to incorrect resource cleanup using the wrong context index in mwifiex_pcie_request_irq() when handling an MSI-X interrupt registration failure. A local user can trigger this error path to leak interrupt resources.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98426
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/03d5e4776e8b71c2468c5c3c48b39202c87a8796
- https://git.kernel.org/stable/c/0969c9688389f2e0f65b1a924b0dd6625a3bb776
- https://git.kernel.org/stable/c/11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd
- https://git.kernel.org/stable/c/1a60cb2292194cc9eafae7ca8a8a72d37ae78d97
- https://git.kernel.org/stable/c/2761b21cb896b1da8dd46cee5084c9032b2d7098
- https://git.kernel.org/stable/c/5fd4cc87e6cc0839aac89c24ebe39ce262fe088f
- https://git.kernel.org/stable/c/a3d722190cdef18da4878b5efc27c3c386dda248
- https://git.kernel.org/stable/c/fcac5813f324cd07dfd36b4adf624fc70f7587d6