Linux Kernel CVE-2026-93796

Requires local access to a system running the Linux kernel iwlwifi PCIe driver (Intel WiFi hardware present and driver loaded). The defective code path is reached only when iwl_pcie_tx_init() fails AFTER RX initialization has already succeeded during nic init, causing iwl_pcie_rx_free() to unwind while leaving rx_pool/global_table/rxq/alloc_page non-NULL; the dangling pointers only cause harm on a subsequent teardown or re-init/retry. Limiting factors: the init-failure trigger is an internal error path not directly attacker-controlled, exploitation is local only (AV:L) with high complexity (AC:H) and requires existing low privileges (PR:L), and affected systems are those on kernels before 6.12.111 / 6.18.53 / 7.2 that have not applied the fix.

This is a classic Linux kernel error-path hardening fix in the iwlwifi PCIe transport, and the intelligence signals point to LOW real-world risk despite the 7.0 (High) CVSS score. The NVD/Linux 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H correctly captures the local vector, high complexity, and required local privileges - but the C:H/I:H/A:H impact triple is very likely overstated: the flaw is stale (non-NULLed) RX pointers left on the live transport object after iwl_pcie_rx_free() runs on a nic-init failure path, which realistically manifests as a use-after-free crash/instability on later teardown or retry rather than a controllable read/write primitive. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code in the input, so exploitation status is 'no public exploit identified at time of analysis.' Critically, the bug is reachable only through an internal error path (iwl_pcie_tx_init() failing AFTER RX init during nic init) that is not attacker-controlled, further reducing practical risk. CWE is listed as N/A but this is effectively CWE-416/CWE-459 (use-after-free / incomplete cleanup), NOT the 'Information Disclosure' the tag implies. Bottom line: high-CVSS-but-low-real-risk latent hardening fix; prioritize via normal kernel patch cadence, not emergency response.

A local low-privileged user (or a hardware/firmware fault) triggers an iwlwifi nic-init sequence in which TX ring initialization fails after RX rings are already set up, causing iwl_pcie_rx_free() to run while leaving rx_pool, global_table, rxq, and alloc_page pointers dangling. A subsequent teardown or driver re-initialization then dereferences the freed RX state, producing a use-after-free that most plausibly crashes the kernel (DoS). No public POC exists, and the local vector plus high attack complexity (racing/forcing a specific init-failure path) make reliable weaponization difficult.