---
id: "CVE-2026-98701"
kind: "vulnerability"
aliases: ["CVE-2026-98701"]
title: "Linux kernel: failed mesh path additions leak slots, blocking new mesh routes"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "mesh-networking", "wifi-embedded"]
not_affected_if: ["no-mesh-interfaces", "no-wifi", "wired-only"]
published_at: "2026-10-18T16:17:23+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:18:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98701", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: failed mesh path additions leak slots, blocking new mesh routes

In the Linux kernel's wifi mac80211 stack, a failed or duplicate mesh path addition keeps its reserved slot, so repeated failures can exhaust the mesh path limit while the table holds fewer paths. The sources describe a denial of service that stops new paths to reachable destinations from being created; they do not describe code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel builds listed in the NVD entry for CVE-2026-98701
- Check whether 802.11s mesh networking is in use with `iw dev` (an interface in mesh point mode)
- unknown for anything beyond this, as the sources do not say

## Fix

- Install the kernel release that includes the upstream mac80211 mesh path quota fix, per your distribution's advisory
- unknown for exact fixed version numbers, as the sources do not say

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98701

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: release mesh path quota on failed additions

Repeated failed or duplicate mesh path additions can exhaust
MESH_MAX_MPATHS while the path table holds fewer paths, which stops new
paths to reachable destinations from being created.

mesh_path_add() reserves a slot before allocating and inserting a path.
If allocation fails, the function returns without releasing the slot. If
the rhashtable insertion reports an error or an existing destination, the
function discards its candidate but retains the reservation. No new path
is installed in any of these cases.

Release the reservation whenever the candidate is not installed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_