{"id":"CVE-2026-98699","kind":"vulnerability","aliases":["CVE-2026-98699"],"related":[],"title":"Linux kernel: mesh Wi-Fi fast transmit path can use freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix mesh fast xmit path deletion UAF\n\nmesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion\nflushes the cache and then frees the path with kfree_rcu(), but a\nlookup that already holds the path can insert a new cache entry\nafter the flush. The cache then points at freed memory.\n\nSet MESH_PATH_DELETED before flushing, and skip inserting a cache\nentry if the path or MPP path is already deleted. Check this under\nthe cache walk lock so it is ordered with the flush. Use WRITE_ONCE()\nfor the deletion flag updates because the cache check reads flags\nwithout taking state_lock.","summary":"In the Linux kernel's mac80211 wireless stack, a mesh path can be freed while a fast transmit cache entry still points to it, because a lookup can re-insert the entry after deletion has flushed the cache. The sources do not state what an attacker gains beyond a use-after-free, so the impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","mesh-networking","wifi"],"not_affected_if":["no-mesh-configured"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the mac80211 mesh fast xmit deletion fix (the sources do not name a version).","status":"open","published_at":"2026-10-18T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:56+00:00","updated_at":"2026-10-25T05:18:56+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:18:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the mac80211 mesh fast xmit deletion fix (the sources do not name a version).","reach":"network","title":"Linux kernel: mesh Wi-Fi fast transmit path can use freed memory","impact":"high","summary":"In the Linux kernel's mac80211 wireless stack, a mesh path can be freed while a fast transmit cache entry still points to it, because a lookup can re-insert the entry after deletion has flushed the cache. The sources do not state what an attacker gains beyond a use-after-free, so the impact is unconfirmed.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","wifi","mesh-networking"],"confidence":0.4,"needs_auth":"unknown","worst_case":"use-after-free in kernel memory; code execution not stated by sources","analyst_note":"Check the NVD entry and the upstream kernel commit for CVSS, the fixed kernel versions and whether an attacker on the radio range can trigger the bug.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-mesh-configured"],"who_is_affected":"Systems running a Linux kernel with mac80211 mesh networking (802.11s) in use, such as mesh Wi-Fi nodes or devices acting as mesh points. Machines without Wi-Fi mesh configured are unlikely to be exposed, but the sources do not say this explicitly.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3469,"output_tokens":545,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98699':16A,19A 'alreadi':132C,171C 'attack':74B 'beyond':76B 'cach':46B,66B,109C,119C,140C,146C,162C,177C,197C 'check':173C,198C 'cve':14A,17A 'delet':62B,104C,116C,155C,172C,192C 'entri':47B,60B,141C,163C 'fast':7A,44B,101C,107C 'fi':6A 'fix':99C 'flag':193C,200C 'flush':64B,117C,144C,157C,186C 'follow':92C 'free':81B,122C 'freed':12A,41B,150C 'gain':75B 'hold':133C 'impact':84B 'infrastructur':20B 'insert':58B,137C,160C 'kernel':2A,23B,31B,90C 'kfree':126C 'linux':1A,22B,30B,89C 'linux-kernel':21B 'lock':179C,204C 'lookup':54B,130C 'mac80211':33B,98C 'memori':13A,151C 'mesh':3A,25B,37B,100C,106C,112C,153C 'mesh-network':24B 'mpp':168C 'network':26B 'new':139C 'order':183C 'path':9A,38B,103C,113C,115C,124C,135C,154C,166C,169C 'point':49B,148C 'pointer':114C 'raw':111C 'rcu':127C 're':57B 're-insert':56B 'read':199C 'resolv':96C 'set':152C 'skip':159C 'sourc':68B 'stack':35B 'state':71B,203C 'still':48B 'store':110C 'take':202C 'transmit':8A,45B 'tx':108C 'uaf':105C 'unconfirm':86B 'updat':194C 'use':11A,79B,187C 'use-after-fre':78B 'vulner':93C 'walk':178C 'wi':5A 'wi-fi':4A 'wifi':27B,97C 'wireless':34B 'without':201C 'write':188C 'xmit':102C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with mac80211 mesh networking (802.11s) in use, such as mesh Wi-Fi nodes or devices acting as mesh points. Machines without Wi-Fi mesh configured are unlikely to be exposed, but the sources do not say this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98699","severity":null,"published_at":"2026-10-18T16:17:23+00:00","modified_at":"2026-10-21T13:21:38+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}