Live › vulnerability › CVE-2026-98701
Go to dashboardIn the Linux kernel's wifi mac80211 stack, a failed or duplicate mesh path addition keeps its reserved slot, so repeated failures can exhaust the mesh path limit while the table holds fewer paths. The sources describe a denial of service that stops new paths to reachable destinations from being created; they do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that use Linux wifi mesh networking (802.11s mesh point interfaces) are exposed, since the flawed code path is mesh_path_add in mac80211. Hosts using ordinary wifi client mode, wired networking or servers without wireless mesh can skip it.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed in the NVD entry for CVE-2026-98701iw dev (an interface in mesh point mode)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: release mesh path quota on failed additions
Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from being created.
mesh_path_add() reserves a slot before allocating and inserting a path. If allocation fails, the function returns without releasing the slot. If the rhashtable insertion reports an error or an existing destination, the function discards its candidate but retains the reservation. No new path is installed in any of these cases.
Release the reservation whenever the candidate is not installed.
This page as .md · .json · in your agent: get_signal("CVE-2026-98701")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.