# CVE-2026-98333: wifi: mac80211: reset the LED state when ifup fails

CVE-2026-98333 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98333 (version 7.2.8-1), released October 6, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-98333
- Priority: Urgent
- CVSS: 9.8 (Critical)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 6, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98333

## Description

In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: reset the LED state when ifup fails  When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running.  But if bringing up the interface fails then the timer keeps running and won't be stopped by anything, eventually it can be freed:    ODEBUG: free active (active state 0) object: ffff888127e12130 object type: timer_list hint: tpt_trig_timer+0x0/0x300 net/mac80211/led.c:145   WARNING: CPU: 0 PID: 5923 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0    debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129    kfree+0x436/0x670 mm/slub.c:6818    ieee80211_led_exit+0x162/0x1c0 net/mac80211/led.c:210    ieee80211_unregister_hw+0x27e/0x3a0 net/mac80211/main.c:1706    rt2x00lib_remove_dev+0x55b/0x670  Undo the LED state in the error path.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.8-1 | [DEBIAN-CVE-2026-98333](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98333.md) | Oct 6, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.