{"id":"CVE-2026-98701","kind":"vulnerability","aliases":["CVE-2026-98701"],"related":[],"title":"Linux kernel: failed mesh path additions leak slots, blocking new mesh routes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: release mesh path quota on failed additions\n\nRepeated failed or duplicate mesh path additions can exhaust\nMESH_MAX_MPATHS while the path table holds fewer paths, which stops new\npaths to reachable destinations from being created.\n\nmesh_path_add() reserves a slot before allocating and inserting a path.\nIf allocation fails, the function returns without releasing the slot. If\nthe rhashtable insertion reports an error or an existing destination, the\nfunction discards its candidate but retains the reservation. No new path\nis installed in any of these cases.\n\nRelease the reservation whenever the candidate is not installed.","summary":"In the Linux kernel's wifi mac80211 stack, a failed or duplicate mesh path addition keeps its reserved slot, so repeated failures can exhaust the mesh path limit while the table holds fewer paths. The sources describe a denial of service that stops new paths to reachable destinations from being created; they do not describe code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","mesh-networking","wifi-embedded"],"not_affected_if":["no-mesh-interfaces","no-wifi","wired-only"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry for CVE-2026-98701\n- Check whether 802.11s mesh networking is in use with `iw dev` (an interface in mesh point mode)\n- unknown for anything beyond this, as the sources do not say","fix":"- Install the kernel release that includes the upstream mac80211 mesh path quota fix, per your distribution's advisory\n- unknown for exact fixed version numbers, as the sources do not say","status":"open","published_at":"2026-10-18T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:53+00:00","updated_at":"2026-10-25T05:18:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:18:53Z","model":"claude-haiku-5-5","output":{"fix":"- Install the kernel release that includes the upstream mac80211 mesh path quota fix, per your distribution's advisory\n- unknown for exact fixed version numbers, as the sources do not say","reach":"network","title":"Linux kernel: failed mesh path additions leak slots, blocking new mesh routes","impact":"low","summary":"In the Linux kernel's wifi mac80211 stack, a failed or duplicate mesh path addition keeps its reserved slot, so repeated failures can exhaust the mesh path limit while the table holds fewer paths. The sources describe a denial of service that stops new paths to reachable destinations from being created; they do not describe code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","mesh-networking","wifi-embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Mesh routing to new destinations stops working; denial of service only","analyst_note":"","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry for CVE-2026-98701\n- Check whether 802.11s mesh networking is in use with `iw dev` (an interface in mesh point mode)\n- unknown for anything beyond this, as the sources do not say","needs_analyst":false,"not_affected_if":["no-mesh-interfaces","wired-only","no-wifi"],"who_is_affected":"Only systems that use Linux wifi mesh networking (802.11s mesh point interfaces) are exposed, since the flawed code path is mesh_path_add in mac80211. Hosts using ordinary wifi client mode, wired networking or servers without wireless mesh can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000656,"input_tokens":3441,"output_tokens":624,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98701':15A,18A 'add':139C 'addit':6A,43B,107C,114C 'alloc':144C,150C 'block':9A 'candid':174C,194C 'case':188C 'code':84B 'creat':79B,136C 'cve':13A,16A 'data':87B 'denial':67B 'describ':65B,83B 'destin':76B,133C,169C 'discard':172C 'duplic':40B,111C 'embed':28B 'error':165C 'execut':85B 'exhaust':52B,116C 'exist':168C 'exposur':88B 'fail':3A,38B,106C,109C,151C 'failur':50B 'fewer':61B,125C 'follow':94C 'function':153C,171C 'hold':60B,124C 'infrastructur':19B 'insert':146C,162C 'instal':183C,197C 'keep':44B 'kernel':2A,22B,32B,92C 'leak':7A 'limit':56B 'linux':1A,21B,31B,91C 'linux-kernel':20B 'mac80211':35B,100C 'max':118C 'mesh':4A,11A,24B,41B,54B,102C,112C,117C,137C 'mesh-network':23B 'mpath':119C 'network':25B 'new':10A,72B,129C,180C 'path':5A,42B,55B,62B,73B,103C,113C,122C,126C,130C,138C,148C,181C 'quota':104C 'reachabl':75B,132C 'releas':101C,156C,189C 'repeat':49B,108C 'report':163C 'reserv':46B,140C,178C,191C 'resolv':98C 'retain':176C 'return':154C 'rhashtabl':161C 'rout':12A 'servic':69B 'slot':8A,47B,142C,158C 'sourc':64B 'stack':36B 'stop':71B,128C 'tabl':59B,123C 'vulner':95C 'whenev':192C 'wifi':27B,34B,99C 'wifi-embed':26B 'without':155C","nicknames":[],"mitigations":[],"who_affected":"Only systems that use Linux wifi mesh networking (802.11s mesh point interfaces) are exposed, since the flawed code path is mesh_path_add in mac80211. Hosts using ordinary wifi client mode, wired networking or servers without wireless mesh can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98701","severity":null,"published_at":"2026-10-18T16:17:23+00:00","modified_at":"2026-10-21T13:21:38+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}