{"api_version":"1","generated_at":"2026-10-24T01:42:27+00:00","cve":"CVE-2026-98333","urls":{"html":"https://cve.report/CVE-2026-98333","api":"https://cve.report/api/cve/CVE-2026-98333.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98333","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98333"},"summary":{"title":"wifi: mac80211: reset the LED state when ifup fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the LED state when ifup fails\n\nWhen the first interface comes up, the radio LED is turned on. This can\nstart the TPT trigger timer, which continues running.\n\nBut if bringing up the interface fails then the timer keeps running and\nwon't be stopped by anything, eventually it can be freed:\n\n  ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145\n  WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0\n   debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129\n   kfree+0x436/0x670 mm/slub.c:6818\n   ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210\n   ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706\n   rt2x00lib_remove_dev+0x55b/0x670\n\nUndo the LED state in the error path.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-06 09:18:25","updated_at":"2026-10-19 10:18:35"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/de6f9561db572df86d65c05545eb2397313bb8a5","name":"https://git.kernel.org/stable/c/de6f9561db572df86d65c05545eb2397313bb8a5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2","name":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98333","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98333","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 67408c8c7b9daf28b50e33be3541334c07d15789 de6f9561db572df86d65c05545eb2397313bb8a5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 67408c8c7b9daf28b50e33be3541334c07d15789 78183e8331958fda11cd2b6850bb424a9747c4b2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.38","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.38 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.8 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"98333","cve":"CVE-2026-98333","epss":"0.001620000","percentile":"0.048440000","score_date":"2026-10-06","updated_at":"2026-10-07 00:14:55"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"de6f9561db572df86d65c05545eb2397313bb8a5","status":"affected","version":"67408c8c7b9daf28b50e33be3541334c07d15789","versionType":"git"},{"lessThan":"78183e8331958fda11cd2b6850bb424a9747c4b2","status":"affected","version":"67408c8c7b9daf28b50e33be3541334c07d15789","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mac80211/iface.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.8","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"2.6.38","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the LED state when ifup fails\n\nWhen the first interface comes up, the radio LED is turned on. This can\nstart the TPT trigger timer, which continues running.\n\nBut if bringing up the interface fails then the timer keeps running and\nwon't be stopped by anything, eventually it can be freed:\n\n  ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145\n  WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0\n   debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129\n   kfree+0x436/0x670 mm/slub.c:6818\n   ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210\n   ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706\n   rt2x00lib_remove_dev+0x55b/0x670\n\nUndo the LED state in the error path."}],"providerMetadata":{"dateUpdated":"2026-10-19T09:17:44.501Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/de6f9561db572df86d65c05545eb2397313bb8a5"},{"url":"https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}],"title":"wifi: mac80211: reset the LED state when ifup fails","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98333","datePublished":"2026-10-06T08:46:25.118Z","dateReserved":"2026-09-25T10:25:14.341Z","dateUpdated":"2026-10-19T09:17:44.501Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-06 09:18:25","lastModifiedDate":"2026-10-19 10:18:35","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98333","Ordinal":"1","Title":"wifi: mac80211: reset the LED state when ifup fails","CVE":"CVE-2026-98333","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98333","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the LED state when ifup fails\n\nWhen the first interface comes up, the radio LED is turned on. This can\nstart the TPT trigger timer, which continues running.\n\nBut if bringing up the interface fails then the timer keeps running and\nwon't be stopped by anything, eventually it can be freed:\n\n  ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145\n  WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0\n   debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129\n   kfree+0x436/0x670 mm/slub.c:6818\n   ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210\n   ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706\n   rt2x00lib_remove_dev+0x55b/0x670\n\nUndo the LED state in the error path.","Type":"Description","Title":"wifi: mac80211: reset the LED state when ifup fails"}]}}}