CVE-2026-80940

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: pci: fix resource leak on failed NAPI setup rtw_pci_probe() allocates PCI resources through rtw_pci_setup_resource() before it sets up NAPI. If rtw_pci_napi_init() fails, the error path jumps straight to err_pci_declaim and skips rtw_pci_destroy(), leaving the PCI resources allocated by rtw_pci_setup_resource() behind. Add a dedicated cleanup label for the NAPI setup failure path so probe destroys the PCI resources. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing current mainline kernels. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have a suitable rtw88 PCI board to test with, no runtime testing was able to be performed.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84
https://git.kernel.org/stable/c/481fff9bda01720c70b19fb260808145a3f21594
https://git.kernel.org/stable/c/b1596e212ab1739930b25b9d3daf6b5cd307b537
https://git.kernel.org/stable/c/e779df4806cd29cbcca5c9dc0a1073662c76b889

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-11 20:18

Updated : 2026-09-11 20:18

NVD link : CVE-2026-80940

Mitre link : CVE-2026-80940

CVE.ORG link : CVE-2026-80940

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80940", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "481fff9bda01720c70b19fb260808145a3f21594", "versionType": "git"}, {"status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84", "versionType": "git"}, {"status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "b1596e212ab1739930b25b9d3daf6b5cd307b537", "versionType": "git"}, {"status": "affected", "version": "d0bcb10e7b94861c714ab1e62c98bf8abaa37527", "lessThan": "e779df4806cd29cbcca5c9dc0a1073662c76b889", "versionType": "git"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wireless/realtek/rtw88/pci.c"], "defaultStatus": "affected"}]}], "published": "2026-09-11T20:18:58.757", "references": [{"url": "https://git.kernel.org/stable/c/34a505071d1ffc5ebf3dc3cd16d2a12b044bcc84", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/481fff9bda01720c70b19fb260808145a3f21594", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b1596e212ab1739930b25b9d3daf6b5cd307b537", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e779df4806cd29cbcca5c9dc0a1073662c76b889", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: pci: fix resource leak on failed NAPI setup\n\nrtw_pci_probe() allocates PCI resources through\nrtw_pci_setup_resource() before it sets up NAPI. If\nrtw_pci_napi_init() fails, the error path jumps straight to\nerr_pci_declaim and skips rtw_pci_destroy(), leaving the PCI\nresources allocated by rtw_pci_setup_resource() behind.\n\nAdd a dedicated cleanup label for the NAPI setup failure path so probe\ndestroys the PCI resources.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing current\nmainline kernels. The tool is still under development and is not yet\npublicly available. Manual inspection confirms that the bug is still\npresent in v7.1-rc7.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have a\nsuitable rtw88 PCI board to test with, no runtime testing was able to be\nperformed."}], "lastModified": "2026-09-11T20:18:58.757", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}