{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98191 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98191 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98191 and fix it if it is affected.\n\nWhat it is: CVE-2026-98191 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98191 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98191/ (Markdown: https://insights.sbomify.com/CVE-2026-98191/index.md)","id":"CVE-2026-98191","markdown":"https://insights.sbomify.com/CVE-2026-98191/index.md","name":"CVE-2026-98191","record":{"aliases":["AZL-106464","BELL-CVE-2026-98191","DEBIAN-CVE-2026-98191","GHSA-gpvf-h969-vp49","UBUNTU-CVE-2026-98191"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"A missing runtime PM reference release in the wlcore Wi-Fi driver can cause resource leaks and potential denial of service when regulatory domain configuration fails.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: release runtime PM ref on regdomain config failure\n\nwlcore_regdomain_config() gets a runtime PM reference before sending\nthe regulatory-domain command. When\nwlcore_cmd_regdomain_config_locked() fails, the function queues recovery\nand returns without dropping that reference.\n\nRelease the reference after handling the command result so both success\nand failure paths balance the preceding\npm_runtime_resume_and_get(). The recovery worker takes a separate\nruntime PM reference and cannot release the reference held here.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: wlcore: release runtime PM ref on regdomain config failure","id":"CVE-2026-98191","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown","id":"CVE-2026-98192"},"packages":[],"prev":{"headline":"wifi: wilc1000: fix out-of-bounds read in P2P public action frames","id":"CVE-2026-98190"},"products":["Linux"],"published":"2026-10-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A missing runtime PM reference release in the wlcore Wi-Fi driver can cause resource leaks and potential denial of service when regulatory domain configuration fails.","url":"https://insights.sbomify.com/CVE-2026-98191/"}