{"id":"CVE-2026-93796","published":"2026-09-24T17:17:12.383","lastModified":"2026-09-25T13:17:20.210","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: pcie: null RX pointers after free\n\nWhen iwl_pcie_tx_init() fails after RX init, nic init unwinds via\niwl_pcie_rx_free().\n\nThe freed RX members stayed non-NULL on the live transport object,\nso later teardown or retry could touch stale RX state.\nSet rx_pool, global_table, rxq, and alloc_page to NULL after free\nto make repeated cleanup and retry paths safe.","cvssScore":7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d","tags":[]},{"url":"https://git.kernel.org/stable/c/3456c5bcc987aeb182e50e30c9b02be8420e9953","tags":[]},{"url":"https://git.kernel.org/stable/c/6ec5bf430cf7466cb412e47f2761594092781fac","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}