Cloudanix VulnDB

CVE-2026-98333

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless setup error on Linux machines can leave behind a running timer that later causes the system to become unstable or crash.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to reset LED state and cancel the TPT trigger timer in the mac80211 interface bring-up error path leaves an active timer_list object that is later freed during ieee80211_unregister_hw, producing a use-after-free of a timer object.

Why it matters to the business

Wireless interface configuration failures on Linux systems can trigger kernel warnings, instability, or crashes that interrupt network connectivity and require system restarts.

How an attack unfolds

An attacker triggers repeated or crafted failures when bringing up a wireless interface, causing the TPT timer to remain active; subsequent hardware unregister frees the live timer, creating a use-after-free window that may be leveraged for memory corruption.

How to fix it

Apply the upstream fix that calls the LED reset routine in the ifup error path; rebuild and deploy the corrected kernel image on affected systems.

How to confirm the fix worked

Boot the patched kernel, deliberately fail an initial wireless interface bring-up, and confirm the ODEBUG warning for tpt_trig_timer no longer appears in dmesg.

Typical attack path

  1. Obtain local or adjacent access to trigger wireless interface configuration
  2. Force or induce failure in the first interface-up path
  3. Allow the orphaned TPT timer to persist until ieee80211_led_exit runs
  4. Trigger kfree of the still-active timer object to enter use-after-free state

How to detect it

Search kernel logs (dmesg, journalctl) for ODEBUG messages referencing free active timer objects and the tpt_trig_timer function in net/mac80211/led.c.

  • ODEBUG: free active (active state 0) object
  • tpt_trig_timer+0x0/0x300
  • ieee80211_led_exit
  • ieee80211_unregister_hw

What your security team should do

  • Prioritize kernel updates for systems exposing wireless interfaces
  • Add kernel log monitoring for mac80211 LED timer warnings
  • Test wireless configuration error paths in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running. But if bringing up the interface fails then the timer keeps running and won't be stopped by anything, eventually it can be freed: ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145 WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129 kfree+0x436/0x670 mm/slub.c:6818 ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210 ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706 rt2x00lib_remove_dev+0x55b/0x670 Undo the LED state in the error path.

Affected packages

Ecosystem Package Introduced Fixed