In the Linux kernel, the following vulnerability has been resolved:

wifi: wlcore: release runtime PM ref on regdomain config failure

wlcore regdomain config() gets a runtime PM reference before sending the regulatory-domain command. When wlcore cmd regdomain config locked() fails, the function queues recovery and returns without dropping that reference.

Release the reference after handling the command result so both success and failure paths balance the preceding pm runtime resume and get(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.