Backtrace

WARNING: CPU: 1 PID: 20 at net/mac80211/main.c:1419 ieee80211_free_ack_frame+0x31/0x40 [mac80211]
Modules linked in: snd_seq_dummy snd_hrtimer xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_nat_tftp nf_conntrack_tftp bridge stp llc nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter qrtr binfmt_misc sunrpc vfat intel_rapl_msr fat iTCO_wdt intel_pmc_bxt iTCO_vendor_support intel_rapl_common kvm_intel rt2800usb snd_usb_audio rt2x00usb kvm snd_usbmidi_lib snd_hda_codec_hdmi rt2800lib snd_rawmidi snd_hda_intel rt2x00lib mc irqbypass squashfs snd_intel_dspcfg mac80211 rapl snd_intel_sdw_acpi loop snd_hda_codec libarc4 snd_hda_core joydev snd_hwdep cfg80211
 snd_seq snd_seq_device rfkill snd_pcm pcspkr i2c_i801 snd_timer i2c_smbus snd soundcore lpc_ich virtio_balloon zram ip_tables nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) hid_logitech_hidpp hid_logitech_dj wacom crct10dif_pclmul crc32_pclmul crc32c_intel drm_kms_helper ghash_clmulni_intel cec drm serio_raw cxgb4vf virtio_console virtio_blk qemu_fw_cfg i2c_dev ipmi_devintf ipmi_msghandler fuse
CPU: 1 PID: 20 Comm: kworker/1:0 Tainted: P S         OE     5.16.16-200.fc35.x86_64 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
Workqueue: usb_hub_wq hub_event
RIP: 0010:ieee80211_free_ack_frame+0x31/0x40 [mac80211]
Code: 29 03 0e 00 00 55 48 89 f5 74 0c 48 89 ef e8 a6 25 a0 f4 31 c0 5d c3 48 c7 c7 5a d4 0c c3 c6 05 09 03 0e 00 01 e8 9a a0 c0 f4 <0f> 0b 48 89 ef e8 85 25 a0 f4 31 c0 5d c3 90 0f 1f 44 00 00 41 57
RSP: 0018:ffffb60dc010bb68 EFLAGS: 00010296
RAX: 0000000000000018 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffffb8634dad RDI: 00000000ffffffff
RBP: ffff95a3812b7100 R08: 0000000000000000 R09: ffffb60dc010b9a8
R10: ffffb60dc010b9a0 R11: ffffffffb8f462a8 R12: 0000000080000000
R13: 0000000000000000 R14: ffff95a38a5a5fd8 R15: ffff95a3acbe0de0
FS:  0000000000000000(0000) GS:ffff95a6efa40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe3d354c7e0 CR3: 000000010249a005 CR4: 0000000000170ee0
Call Trace:
 <TASK>
 ? ieee80211_free_hw+0x90/0x90 [mac80211]
 idr_for_each+0x4e/0xc0
 ieee80211_free_hw+0x2f/0x90 [mac80211]
 rt2x00usb_disconnect+0x6d/0x90 [rt2x00usb]
 usb_unbind_interface+0x8a/0x270
 ? kernfs_find_ns+0x35/0xd0
 __device_release_driver+0x244/0x250
 device_release_driver+0x24/0x30
 bus_remove_device+0xd8/0x140
 device_del+0x18b/0x400
 ? kobject_put+0x91/0x1d0
 usb_disable_device+0xc6/0x1e0
 usb_disconnect.cold+0x7b/0x24d
 hub_event+0xc04/0x17b0
 ? __schedule+0x2df/0xfa0
 process_one_work+0x1e8/0x3c0
 worker_thread+0x50/0x3b0
 ? rescuer_thread+0x370/0x370
 kthread+0x16b/0x190
 ? set_kthread_struct+0x40/0x40
 ret_from_fork+0x22/0x30
 </TASK>