CVE-2026-98191

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcore_regdomain_config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore_cmd_regdomain_config_locked() fails, the function queues recovery and returns without dropping that reference. Release the reference after handling the command result so both success and failure paths balance the preceding pm_runtime_resume_and_get(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.

Is your site exposed to CVE-2026-98191?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/05b5e297bbf46f92c80da4c2ebe67828ca0d0247 https://git.kernel.org/stable/c/18eb148105f1af9163f5e9758f0a7bc6ab042423 https://git.kernel.org/stable/c/3fbaae01bb7847d8b0124a8bbdb3af865e388d53 https://git.kernel.org/stable/c/7f1f25b2db14683ab75d0d22c00d6a75ba988b83 https://git.kernel.org/stable/c/85ec6c451fe681ac3135dfa43a519f1404ae63ad https://git.kernel.org/stable/c/8a1f3cf89ddcc700e25afe42cfad333059adcc94 https://git.kernel.org/stable/c/a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4 https://git.kernel.org/stable/c/c02352e2b5a241c8da89b5f5f1a0ae4d403120ed

Frequently Asked Questions

What is CVE-2026-98191? +

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcore_regdomain_config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore_cmd_regdomain_config_locked() fails, the function queues recovery and returns without dropping that reference. Release the reference after handling the command result so both success and failure paths balance the preceding pm_runtime_resume_and_get(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.

How do I check if I'm vulnerable to CVE-2026-98191? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.