UBUNTU-CVE-2026-98333: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running. But if bringing up the interface fails then the timer keeps running and won't be stopped by anything, eventually it can be freed: ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timerlist hint: tpttrigtimer+0x0/0x300 net/mac80211/led.c:145 WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debugprintobject+0x1a2/0x2b0 debugchecknoobjfreed+0x4b7/0x600 lib/debugobjects.c:1129 kfree+0x436/0x670 mm/slub.c:6818 ieee80211ledexit+0x162/0x1c0 net/mac80211/led.c:210 ieee80211unregisterhw+0x27e/0x3a0 net/mac80211/main.c:1706 rt2x00libremovedev+0x55b/0x670 Undo the LED state in the error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mac80211, reset or undo the LED state in the error path when interface bring-up (ifup) fails, stopping the TPT trigger timer before cleanup.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages are exposed when they use the mac80211 Wi-Fi subsystem and an interface bring-up attempt can fail. The listed packages include linux, linux-fips, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants.
What conditions trigger the problem?
The issue occurs when the first Wi-Fi interface is brought up, which turns on the radio LED and can start the throughput-trigger timer, but the interface bring-up then fails. The timer can remain active and later be freed during device removal or kernel cleanup.
What is the likely impact?
The active timer may be freed while still running, producing a kernel debug-object warning during Wi-Fi hardware unregister or device removal. The vulnerability is rated high with impacts to confidentiality, integrity, and availability in the supplied vector.
Is this remotely exploitable by an unauthenticated attacker?
The supplied vector lists local attack access and high privileges required, with no user interaction required. It does not indicate network-based exploitation.