CVE-2026-98333: wifi: mac80211: reset the LED state when ifup fails
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reset the LED state when ifup fails
When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running.
But if bringing up the interface fails then the timer keeps running and won't be stopped by anything, eventually it can be freed:
ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timerlist hint: tpttrigtimer+0x0/0x300 net/mac80211/led.c:145 WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debugprintobject+0x1a2/0x2b0 debugchecknoobjfreed+0x4b7/0x600 lib/debugobjects.c:1129 kfree+0x436/0x670 mm/slub.c:6818 ieee80211ledexit+0x162/0x1c0 net/mac80211/led.c:210 ieee80211unregisterhw+0x27e/0x3a0 net/mac80211/main.c:1706 rt2x00libremovedev+0x55b/0x670
Undo the LED state in the error path.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this issue occur?
It can occur when the first mac80211 wireless interface begins coming up, turns on the radio LED and starts the TPT trigger timer, but the interface bring-up then fails. The timer can remain active until the wireless hardware is unregistered.
What is the observable impact?
During wireless hardware removal or cleanup, the kernel can attempt to free an active timer. With debug objects enabled, this is reported as an ODEBUG "free active" warning involving the mac80211 TPT trigger timer.
Is there a workaround if the fix cannot be applied immediately?
The provided information does not identify a configuration workaround. Avoiding failed initial wireless-interface bring-up and unloading or removing the affected hardware after such a failure may reduce exposure, but the documented remediation is to reset the LED state in the interface-up error path.
How can an administrator identify a potentially affected system?
Check kernel logs for an ODEBUG "free active" timer_list message, with a stack trace through tpt_trig_timer, ieee80211_led_exit, and ieee80211_unregister_hw. The issue is associated with a failed first wireless interface bring-up followed by device unregister or removal.