CVE-2026-98191
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcore_regdomain_config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore_cmd_regdomain_config_locked() fails, the function queues recovery and returns without dropping that reference. Release the reference after handling the command result so both success and failure paths balance the preceding pm_runtime_resume_and_get(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.
Affected versions
Linux kernel versions
4.19
and later are affected. Fixed in
5.10.271,
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.54,
7.2.8,
7.3-rc4
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-98191?
CVE-2026-98191 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.19 onward and has been patched in 5.10.271, 5.15.222, 6.1.189 and others. CVE-2026-98191 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98191?
Yes. CVE-2026-98191 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others. If you are running Linux kernel 4.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98191 actively exploited?
No. CVE-2026-98191 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.