CVE-2026-98191wifi: wlcore: release runtime PM ref on regdomain config failure
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcore_regdomain_config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore_cmd_regdomain_config_locked() fails, the function queues recovery and returns without dropping that reference. Release the reference after handling the command result so both success and failure paths balance the preceding pm_runtime_resume_and_get(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 13 days later
· 13 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < 85ec6c451fe681ac3135dfa43a519f1404ae63ad
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < 3fbaae01bb7847d8b0124a8bbdb3af865e388d53
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < c02352e2b5a241c8da89b5f5f1a0ae4d403120ed
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < 05b5e297bbf46f92c80da4c2ebe67828ca0d0247
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < 18eb148105f1af9163f5e9758f0a7bc6ab042423
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < 7f1f25b2db14683ab75d0d22c00d6a75ba988b83
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4
- affected fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 – < 8a1f3cf89ddcc700e25afe42cfad333059adcc94
- affected 4.19
- unaffected < 4.19
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/85ec6c451fe681ac3135dfa43a519f1404ae63ad (opens in a new tab)
- https://git.kernel.org/stable/c/3fbaae01bb7847d8b0124a8bbdb3af865e388d53 (opens in a new tab)
- https://git.kernel.org/stable/c/c02352e2b5a241c8da89b5f5f1a0ae4d403120ed (opens in a new tab)
- https://git.kernel.org/stable/c/05b5e297bbf46f92c80da4c2ebe67828ca0d0247 (opens in a new tab)
- https://git.kernel.org/stable/c/18eb148105f1af9163f5e9758f0a7bc6ab042423 (opens in a new tab)
- https://git.kernel.org/stable/c/7f1f25b2db14683ab75d0d22c00d6a75ba988b83 (opens in a new tab)
- https://git.kernel.org/stable/c/a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4 (opens in a new tab)
- https://git.kernel.org/stable/c/8a1f3cf89ddcc700e25afe42cfad333059adcc94 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93119 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98191)Record last updated .