VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98191: Linux kernel · wifi: wlcore: release runtime PM ref on regdomain config failure

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in c02352e2b5a241c8da89b5f5f1a0ae4d403120ed : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c02352e2b5a241c8da89b5f5f1a0ae4d403120ed, a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4, 85ec6c451fe681ac3135dfa43a519f1404ae63ad +5

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8, < c02352e2b5a241c8da89b5f5f1a0ae4d403120ed	Fixed in c02352e2b5a241c8da89b5f5f1a0ae4d403120ed
LinuxLinux	Affected ≥ fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8, < a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4	Fixed in a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4
LinuxLinux	Affected ≥ fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8, < 85ec6c451fe681ac3135dfa43a519f1404ae63ad	Fixed in 85ec6c451fe681ac3135dfa43a519f1404ae63ad
LinuxLinux	Affected ≥ fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8, < 18eb148105f1af9163f5e9758f0a7bc6ab042423	Fixed in 18eb148105f1af9163f5e9758f0a7bc6ab042423
LinuxLinux	Affected ≥ fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8, < 8a1f3cf89ddcc700e25afe42cfad333059adcc94	Fixed in 8a1f3cf89ddcc700e25afe42cfad333059adcc94
LinuxLinux	Affected ≥ fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8, < 7f1f25b2db14683ab75d0d22c00d6a75ba988b83	Fixed in 7f1f25b2db14683ab75d0d22c00d6a75ba988b83

AI-suggested

A fix is available in the Linux kernel as indicated by the presence of fixed commits. Users should update to a Linux kernel version that includes these fixes to resolve the issue.

Description

A flaw in the Linux kernel's wlcore driver caused a runtime power management reference to not be released on regulatory domain configuration failure. This could lead to resource mismanagement in the power management subsystem. The issue has been fixed by ensuring the reference is released regardless of success or failure in the regulatory domain configuration command.

Impact

The vulnerability could cause improper management of runtime power management references, potentially leading to resource leaks or power management inconsistencies in affected Linux kernel versions. There is no indication of direct security compromise or exploitation in the wild.

Summary

In the Linux kernel's wlcore driver, the function wlcore_regdomain_config() acquires a runtime PM reference before sending a regulatory-domain command. If wlcore_cmd_regdomain_config_locked() fails, the function previously queued recovery and returned without releasing that runtime PM reference, causing an imbalance. The fix ensures that the runtime PM reference is released after handling the command result on both success and failure paths, preventing resource leaks. The recovery worker takes a separate runtime PM reference and cannot release the one held in wlcore_regdomain_config().

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:26 UTC

Technical details

References

Community reviews

Related threats