CVE-2026-80940

Received Received - Intake

Resource Leak in Linux Kernel WiFi Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: pci: fix resource leak on failed NAPI setup rtw_pci_probe() allocates PCI resources through rtw_pci_setup_resource() before it sets up NAPI. If rtw_pci_napi_init() fails, the error path jumps straight to err_pci_declaim and skips rtw_pci_destroy(), leaving the PCI resources allocated by rtw_pci_setup_resource() behind. Add a dedicated cleanup label for the NAPI setup failure path so probe destroys the PCI resources. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing current mainline kernels. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc7. An x86_64 allyesconfig build showed no new warnings. As we do not have a suitable rtw88 PCI board to test with, no runtime testing was able to be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80940

EUVD

EUVD-2026-76263

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	From 7.1-rc7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a resource leak vulnerability in the Linux kernel's wifi driver rtw88 for PCI devices. During device probe, PCI resources are allocated before NAPI (New API for network processing) setup. If NAPI setup fails, the error handling skips resource cleanup, leaving allocated PCI resources unreleased.

Detection Guidance

This vulnerability is specific to the Linux kernel's rtw88 WiFi driver and may not have direct detection commands. Check kernel logs for errors related to rtw88 or NAPI initialization failures. Monitor for resource leaks in PCI devices using tools like lspci or dmesg.

Impact Analysis

This could lead to gradual system resource exhaustion. Over time, repeated probe failures might deplete available PCI resources, potentially causing system instability or denial of service for wifi functionality on affected devices.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-80940. If immediate patching is not possible, disable the rtw88 driver module to prevent potential resource leaks.

Hi! I’m here to help you understand CVE-2026-80940. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70