HIGH Introduced in 5.12
iwlwifi RxPointer UAF
CVE-2026-93796
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free(). The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to make repeated cleanup and retry paths safe.
02KernelScan AI Analysis
Risk summary
Systems with Intel WiFi hardware are at risk when the driver's transmit initialization fails, leaving stale receive pointers that can be dereferenced on retry or teardown. A local attacker with CAP_NET_ADMIN who can trigger device reinitialization could exploit this to corrupt kernel memory or crash the system.
Vulnerability analysis
If the Intel WiFi driver's transmit setup fails after receive setup has already finished, the error cleanup frees the receive buffers but forgets to clear the saved addresses. If the driver later retries setup or tears down, it may follow those stale addresses, accessing memory that has already been freed and possibly reused elsewhere. The fix clears each address immediately after freeing its buffer, so any later access sees an empty pointer instead of a stale one. The issue only affects systems with Intel WiFi hardware, and the trigger is a local action that forces device reinitialization—normally requiring privileged network-admin access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.12 | 6.12.111 | 6ec5bf430cf7 |
| 6.18 | 5.12 | 6.18.53 | 3456c5bcc987 |
| mainline | 5.12 | 7.2 | 2c79d7a7b583 |
| cip/6.12 | 5.12 | 6.12.111-cip32 | 6ec5bf430cf7 |