{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-98426",
  "modified": "2026-10-14T19:51:56Z",
  "upstream": [
    "CVE-2026-98426"
  ],
  "published": "2026-10-14T13:30:30Z",
  "summary": "wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path\n\nmwifiex_pcie_request_irq() registers each MSI-X vector with a per-index\ndev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop\n\"for (j = 0; j < i; j++)\" frees msix_entries[j].vector but passes the\nfailed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on\n(irq, dev_id), so it fails to find the action registered with\n&card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and\nfree_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.189",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98426"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1a60cb2292194cc9eafae7ca8a8a72d37ae78d97"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fcac5813f324cd07dfd36b4adf624fc70f7587d6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2761b21cb896b1da8dd46cee5084c9032b2d7098"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5fd4cc87e6cc0839aac89c24ebe39ce262fe088f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0969c9688389f2e0f65b1a924b0dd6625a3bb776"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/03d5e4776e8b71c2468c5c3c48b39202c87a8796"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a3d722190cdef18da4878b5efc27c3c386dda248"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-10-14T13:30:30Z"
  }
}