CVE-2026-98333

A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. When bringing up a wireless interface fails, the system does not reset the radio LED state, leaving an internal throughput timer running. Consequently, when the wireless device is subsequently removed or unregistered, the active timer memory object may be freed while still in use. A local user could exploit this flaw to cause memory corruption and trigger a kernel crash, resulting in a Denial of Service (DoS).

mac80211 can leave the throughput LED trigger timer active when the first interface ifup operation fails. A later ieee80211_unregister_hw() path can free the LED state while the timer remains active, creating a credible timer use-after-free condition in tpt_trig_timer() rather than only a resource leak. Triggering requires a supported wireless device, failure of the first interface open operation, and subsequent hardware unregister or driver removal while the timer is pending. For the CVSS the PR:L value is used because a local user or service with delegated network administration capability can initiate interface state changes without requiring unrestricted host root. The issue is not directly network reachable through wireless packets. Impact is at least local denial of service through a kernel warning or crash and may include confidentiality and integrity impact if the freed timer storage is reused before the callback executes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.