CVE-2026-98191 wifi: wlcore: release runtime PM ref on regdomain config failure
A missing runtime PM reference release in the wlcore Wi-Fi driver can cause resource leaks and potential denial of service when regulatory domain configuration fails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98191?
CVE-2026-98191 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: wlcore: release runtime PM ref on regdomain config failure
wlcore_regdomain_config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore_cmd_regdomain_config_locked() fails, the function queues recovery and returns without dropping that reference.
Release the reference after handling the command result so both success and failure paths balance the preceding pm_runtime_resume_and_get(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.
Which versions are affected by CVE-2026-98191?
How do I fix CVE-2026-98191?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98191 being exploited?
There is no known exploitation of CVE-2026-98191 in the wild and no public exploit code.
Sources
Also known as AZL-106464, BELL-CVE-2026-98191, DEBIAN-CVE-2026-98191, GHSA-gpvf-h969-vp49, UBUNTU-CVE-2026-98191.