CVE-2026-80940

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80940", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.803Z", "datePublished": "2026-09-11T19:42:13.084Z", "dateUpdated": "2026-10-19T08:45:24.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:45:24.150Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: pci: fix resource leak on failed NAPI setup\n\nrtw_pci_probe() allocates PCI resources through\nrtw_pci_setup_resource() before it sets up NAPI. If\nrtw_pci_napi_init() fails, the error path jumps straight to\nerr_pci_declaim and skips rtw_pci_destroy(), leaving the PCI\nresources allocated by rtw_pci_setup_resource() behind.\n\nAdd a dedicated cleanup label for the NAPI setup failure path so probe\ndestroys the PCI resources.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing current\nmainline kernels. The tool is still under development and is not yet\npublicly available. Manual inspection confirms that the bug is still\npresent in v7.1-rc7.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have a\nsuitable rtw88 PCI board to test with, no runtime testing was able to be\nperformed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "versions": [{"version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "481fff9bda01720c70b19fb260808145a3f21594", "status": "affected", "versionType": "git"}, {"version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84", "status": "affected", "versionType": "git"}, {"version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "b1596e212ab1739930b25b9d3daf6b5cd307b537", "status": "affected", "versionType": "git"}, {"version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "e779df4806cd29cbcca5c9dc0a1073662c76b889", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/481fff9bda01720c70b19fb260808145a3f21594"}, {"url": "https://git.kernel.org/stable/c/34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84"}, {"url": "https://git.kernel.org/stable/c/b1596e212ab1739930b25b9d3daf6b5cd307b537"}, {"url": "https://git.kernel.org/stable/c/e779df4806cd29cbcca5c9dc0a1073662c76b889"}], "title": "wifi: rtw88: pci: fix resource leak on failed NAPI setup", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "481fff9bda01720c70b19fb260808145a3f21594", "status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "versionType": "git"}, {"lessThan": "34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84", "status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "versionType": "git"}, {"lessThan": "b1596e212ab1739930b25b9d3daf6b5cd307b537", "status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "versionType": "git"}, {"lessThan": "e779df4806cd29cbcca5c9dc0a1073662c76b889", "status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: pci: fix resource leak on failed NAPI setup\n\nrtw_pci_probe() allocates PCI resources through\nrtw_pci_setup_resource() before it sets up NAPI. If\nrtw_pci_napi_init() fails, the error path jumps straight to\nerr_pci_declaim and skips rtw_pci_destroy(), leaving the PCI\nresources allocated by rtw_pci_setup_resource() behind.\n\nAdd a dedicated cleanup label for the NAPI setup failure path so probe\ndestroys the PCI resources.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing current\nmainline kernels. The tool is still under development and is not yet\npublicly available. Manual inspection confirms that the bug is still\npresent in v7.1-rc7.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have a\nsuitable rtw88 PCI board to test with, no runtime testing was able to be\nperformed."}], "id": "CVE-2026-80940", "lastModified": "2026-10-19T09:17:25.230", "metrics": {}, "published": "2026-09-11T20:18:58.757", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/481fff9bda01720c70b19fb260808145a3f21594"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1596e212ab1739930b25b9d3daf6b5cd307b537"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e779df4806cd29cbcca5c9dc0a1073662c76b889"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Kernel: Resource leak in rtw88 PCI driver can lead to Denial of Service.", "id": "2532366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532366"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's rtw88 PCI driver. During the probe process, if the NAPI (Networked Attached Peripheral Interface) setup fails, allocated PCI resources are not properly released. This resource leak could potentially lead to a Denial of Service (DoS) due to resource exhaustion, impacting system stability."], "name": "CVE-2026-80940", "public_date": "2026-09-11T19:42:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80940\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80940\nhttps://git.kernel.org/stable/c/34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84\nhttps://git.kernel.org/stable/c/481fff9bda01720c70b19fb260808145a3f21594\nhttps://git.kernel.org/stable/c/b1596e212ab1739930b25b9d3daf6b5cd307b537\nhttps://git.kernel.org/stable/c/e779df4806cd29cbcca5c9dc0a1073662c76b889"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d0bcb10e7b94861c714ab1e62c98bf8abaa37527,481fff9bda01720c70b19fb260808145a3f21594)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d0bcb10e7b94861c714ab1e62c98bf8abaa37527,34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d0bcb10e7b94861c714ab1e62c98bf8abaa37527,b1596e212ab1739930b25b9d3daf6b5cd307b537)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d0bcb10e7b94861c714ab1e62c98bf8abaa37527,e779df4806cd29cbcca5c9dc0a1073662c76b889)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-13T11:45:19.069276+00:00", "updated": "2026-09-21T04:15:08.804874+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}