In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: pcie: null RX pointers after free

When iwl pcie tx init() fails after RX init, nic init unwinds via iwl pcie rx free().

The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx pool, global table, rxq, and alloc page to NULL after free to make repeated cleanup and retry paths safe.