CVE-2026-98333

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98333", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.341Z", "datePublished": "2026-10-06T08:46:25.118Z", "dateUpdated": "2026-10-19T09:17:44.501Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:44.501Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the LED state when ifup fails\n\nWhen the first interface comes up, the radio LED is turned on. This can\nstart the TPT trigger timer, which continues running.\n\nBut if bringing up the interface fails then the timer keeps running and\nwon't be stopped by anything, eventually it can be freed:\n\n ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145\n WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0\n debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129\n kfree+0x436/0x670 mm/slub.c:6818\n ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210\n ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706\n rt2x00lib_remove_dev+0x55b/0x670\n\nUndo the LED state in the error path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/iface.c"], "versions": [{"version": "67408c8c7b9daf28b50e33be3541334c07d15789", "lessThan": "de6f9561db572df86d65c05545eb2397313bb8a5", "status": "affected", "versionType": "git"}, {"version": "67408c8c7b9daf28b50e33be3541334c07d15789", "lessThan": "78183e8331958fda11cd2b6850bb424a9747c4b2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/iface.c"], "versions": [{"version": "2.6.38", "status": "affected"}, {"version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.38", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/de6f9561db572df86d65c05545eb2397313bb8a5"}, {"url": "https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}], "title": "wifi: mac80211: reset the LED state when ifup fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/iface.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "de6f9561db572df86d65c05545eb2397313bb8a5", "status": "affected", "version": "67408c8c7b9daf28b50e33be3541334c07d15789", "versionType": "git"}, {"lessThan": "78183e8331958fda11cd2b6850bb424a9747c4b2", "status": "affected", "version": "67408c8c7b9daf28b50e33be3541334c07d15789", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/iface.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.38"}, {"lessThan": "2.6.38", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the LED state when ifup fails\n\nWhen the first interface comes up, the radio LED is turned on. This can\nstart the TPT trigger timer, which continues running.\n\nBut if bringing up the interface fails then the timer keeps running and\nwon't be stopped by anything, eventually it can be freed:\n\n ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145\n WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0\n debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129\n kfree+0x436/0x670 mm/slub.c:6818\n ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210\n ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706\n rt2x00lib_remove_dev+0x55b/0x670\n\nUndo the LED state in the error path."}], "id": "CVE-2026-98333", "lastModified": "2026-10-19T10:18:35.513", "metrics": {}, "published": "2026-10-06T09:18:25.780", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/78183e8331958fda11cd2b6850bb424a9747c4b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de6f9561db572df86d65c05545eb2397313bb8a5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mac80211: reset the LED state when ifup fails", "id": "2546418", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546418"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: reset the LED state when ifup fails\nWhen the first interface comes up, the radio LED is turned on. This can\nstart the TPT trigger timer, which continues running.\nBut if bringing up the interface fails then the timer keeps running and\nwon't be stopped by anything, eventually it can be freed:\nODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145\nWARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0\ndebug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129\nkfree+0x436/0x670 mm/slub.c:6818\nieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210\nieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706\nrt2x00lib_remove_dev+0x55b/0x670\nUndo the LED state in the error path.", "A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. When bringing up a wireless interface fails, the system does not reset the radio LED state, leaving an internal throughput timer running. Consequently, when the wireless device is subsequently removed or unregistered, the active timer memory object may be freed while still in use. A local user could exploit this flaw to cause memory corruption and trigger a kernel crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98333", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98333\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98333\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98333.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[67408c8c7b9daf28b50e33be3541334c07d15789,de6f9561db572df86d65c05545eb2397313bb8a5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[67408c8c7b9daf28b50e33be3541334c07d15789,78183e8331958fda11cd2b6850bb424a9747c4b2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.38"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.38)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:45:18.455511+00:00", "updated": "2026-10-11T05:30:17.273640+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}