CVE-2026-98710

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98710", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.365Z", "datePublished": "2026-10-18T15:46:40.790Z", "dateUpdated": "2026-10-30T12:39:01.294Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:39:01.294Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: 3945: free EEPROM data on remove\n\nil3945_pci_probe() calls il_eeprom_init(), which allocates memory for\nthe EEPROM data. The probe failure paths release this allocation with\nil_eeprom_free(), but the remove path does not free it after a\nsuccessful probe.\n\nAs a result, the EEPROM data is leaked when the PCI device is removed.\n\nFree the EEPROM data in il3945_pci_remove() before releasing the\nmac80211 hardware structure.\n\nThis issue was found by manual code inspection."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlegacy/3945-mac.c"], "versions": [{"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "52990dd317f76c1baa3665e3b1513cf3d4b48f5e", "status": "affected", "versionType": "git"}, {"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "a17d3fbca1731ae84c03a3dea0970f62f19757fb", "status": "affected", "versionType": "git"}, {"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "39a3af97a23f6778887528c1fb4ffc60017ed0e6", "status": "affected", "versionType": "git"}, {"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "3ebc529726c0c038f49e513a7a6f1893552ee803", "status": "affected", "versionType": "git"}, {"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "ab7bee2cd55f665cb29fa0ace2ec14020e0a452e", "status": "affected", "versionType": "git"}, {"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "cd8f8f45d81aac384311701d7ffe26567af2e783", "status": "affected", "versionType": "git"}, {"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "89f9d6186dc7429f38132635526e28549c913c0b", "status": "affected", "versionType": "git"}, {"version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "lessThan": "f8ebe286394c0bbb4a6dbacb182a34ab6376922d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/intel/iwlegacy/3945-mac.c"], "versions": [{"version": "2.6.27", "status": "affected"}, {"version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/52990dd317f76c1baa3665e3b1513cf3d4b48f5e"}, {"url": "https://git.kernel.org/stable/c/a17d3fbca1731ae84c03a3dea0970f62f19757fb"}, {"url": "https://git.kernel.org/stable/c/39a3af97a23f6778887528c1fb4ffc60017ed0e6"}, {"url": "https://git.kernel.org/stable/c/3ebc529726c0c038f49e513a7a6f1893552ee803"}, {"url": "https://git.kernel.org/stable/c/ab7bee2cd55f665cb29fa0ace2ec14020e0a452e"}, {"url": "https://git.kernel.org/stable/c/cd8f8f45d81aac384311701d7ffe26567af2e783"}, {"url": "https://git.kernel.org/stable/c/89f9d6186dc7429f38132635526e28549c913c0b"}, {"url": "https://git.kernel.org/stable/c/f8ebe286394c0bbb4a6dbacb182a34ab6376922d"}], "title": "wifi: iwlegacy: 3945: free EEPROM data on remove", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlegacy/3945-mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "52990dd317f76c1baa3665e3b1513cf3d4b48f5e", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}, {"lessThan": "a17d3fbca1731ae84c03a3dea0970f62f19757fb", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}, {"lessThan": "39a3af97a23f6778887528c1fb4ffc60017ed0e6", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}, {"lessThan": "3ebc529726c0c038f49e513a7a6f1893552ee803", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}, {"lessThan": "ab7bee2cd55f665cb29fa0ace2ec14020e0a452e", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}, {"lessThan": "cd8f8f45d81aac384311701d7ffe26567af2e783", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}, {"lessThan": "89f9d6186dc7429f38132635526e28549c913c0b", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}, {"lessThan": "f8ebe286394c0bbb4a6dbacb182a34ab6376922d", "status": "affected", "version": "073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/intel/iwlegacy/3945-mac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: 3945: free EEPROM data on remove\n\nil3945_pci_probe() calls il_eeprom_init(), which allocates memory for\nthe EEPROM data. The probe failure paths release this allocation with\nil_eeprom_free(), but the remove path does not free it after a\nsuccessful probe.\n\nAs a result, the EEPROM data is leaked when the PCI device is removed.\n\nFree the EEPROM data in il3945_pci_remove() before releasing the\nmac80211 hardware structure.\n\nThis issue was found by manual code inspection."}], "id": "CVE-2026-98710", "lastModified": "2026-10-30T13:21:20.490", "metrics": {}, "published": "2026-10-18T16:17:24.540", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/39a3af97a23f6778887528c1fb4ffc60017ed0e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ebc529726c0c038f49e513a7a6f1893552ee803"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/52990dd317f76c1baa3665e3b1513cf3d4b48f5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89f9d6186dc7429f38132635526e28549c913c0b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a17d3fbca1731ae84c03a3dea0970f62f19757fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab7bee2cd55f665cb29fa0ace2ec14020e0a452e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd8f8f45d81aac384311701d7ffe26567af2e783"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8ebe286394c0bbb4a6dbacb182a34ab6376922d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: iwlegacy: 3945: free EEPROM data on remove", "id": "2555075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555075"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: iwlegacy: 3945: free EEPROM data on remove\nil3945_pci_probe() calls il_eeprom_init(), which allocates memory for\nthe EEPROM data. The probe failure paths release this allocation with\nil_eeprom_free(), but the remove path does not free it after a\nsuccessful probe.\nAs a result, the EEPROM data is leaked when the PCI device is removed.\nFree the EEPROM data in il3945_pci_remove() before releasing the\nmac80211 hardware structure.\nThis issue was found by manual code inspection.", "A flaw was found in the Linux kernel's iwlegacy wireless driver. The driver fails to release memory allocated for device configuration data when a wireless network device is removed from the system. A local user could exploit this vulnerability by repeatedly triggering device disconnection or unbinding, causing a kernel memory leak that may lead to system memory exhaustion and a Denial of Service (DoS)."], "name": "CVE-2026-98710", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98710\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98710\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98710.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73,ab7bee2cd55f665cb29fa0ace2ec14020e0a452e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73,cd8f8f45d81aac384311701d7ffe26567af2e783)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73,89f9d6186dc7429f38132635526e28549c913c0b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[073d3f5f1b3b6512eb82a3d40c84dedb14dc6f73,f8ebe286394c0bbb4a6dbacb182a34ab6376922d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.27"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.27)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:15:14.438483+00:00", "updated": "2026-10-23T06:15:13.081278+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}