CVE-2026-93796

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93796
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93796.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93796
Downstream
Published
2026-09-24T16:02:29Z
Modified
2026-11-01T02:31:03Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
wifi: iwlwifi: pcie: null RX pointers after free
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: pcie: null RX pointers after free

When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free().

The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to make repeated cleanup and retry paths safe.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93796.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9cf671d60fdbeb8f875859c11148cf13c326ada2
Fixed
847103369489110a222482c7781e0fe62cdbd3d5
Fixed
c422d5d53f135ea987f745773953a91f9fe30c3f
Fixed
6ec5bf430cf7466cb412e47f2761594092781fac
Fixed
3456c5bcc987aeb182e50e30c9b02be8420e9953
Fixed
2c79d7a7b583050c9f58041465cb46fe3483ab5d

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93796.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.12.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93796.json"