UBUNTU-CVE-2026-93796: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwlpcietxinit() fails after RX init, nic init unwinds via iwlpcierxfree(). The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rxpool, globaltable, rxq, and allocpage to NULL after free to make repeated cleanup and retry paths safe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Set rx_pool, global_table, rxq, and alloc_page to NULL in iwl_pcie_rx_free() after freeing them, so repeated cleanup and retry paths cannot use stale RX state.
Linux kernel iwlwifi PCIe RX cleanup rx_pool, global_table, rxq, alloc_page = NULL after free
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The affected software list includes Ubuntu kernel packages for standard, FIPS, AWS, Azure, and GCP deployments. The vulnerable code is in the iwlwifi PCIe Wi-Fi driver, so exposure is relevant where that driver and compatible Wi-Fi hardware are in use.
What conditions are required to trigger the flaw?
The issue occurs when iwl_pcie_tx_init() fails after RX initialization. A subsequent teardown or retry path can then access RX state that was freed but whose pointers were not cleared.
What is the practical impact of the stale pointers?
Later cleanup or initialization retry operations may touch stale RX pointers on the live transport object. The stated fix clears rx_pool, global_table, rxq, and alloc_page after they are freed, making repeated cleanup and retry paths safe.