CVE-2026-93796: wifi: iwlwifi: pcie: null RX pointers after free
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: null RX pointers after free
When iwlpcietxinit() fails after RX init, nic init unwinds via iwlpcierxfree().
The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rxpool, globaltable, rxq, and allocpage to NULL after free to make repeated cleanup and retry paths safe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In iwl_pcie_rx_free(), set rx_pool, global_table, rxq, and alloc_page to NULL after freeing them so repeated cleanup and retry paths cannot access stale RX state.
Event History
Frequently Asked Questions
When can this issue be triggered?
It occurs when iwl_pcie_tx_init() fails after RX initialization has completed. The subsequent initialization unwind frees RX resources but leaves RX-related pointers non-NULL, allowing later cleanup or retry paths to access stale state.
Which systems are exposed?
Systems using the Linux kernel iwlwifi PCIe transport are relevant, specifically where the affected initialization failure, teardown, or retry sequence can occur. The provided information does not identify particular hardware models, kernel versions, or default configurations.
What is the practical remediation?
Apply a Linux kernel update containing the referenced fixes. The fix clears rx_pool, global_table, rxq, and alloc_page after they are freed so repeated cleanup and retry paths do not retain stale RX pointers.