Live › vulnerability › CVE-2026-98705
Go to dashboardA flaw in the Linux kernel's mac80211 mesh Wi-Fi code lets proxy-path churn corrupt the counter that enforces the mesh path limit, so more paths than MESH_MAX_MPATHS can be installed. The sources do not state a direct code-execution or data-theft outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Linux kernels with mac80211 mesh networking enabled, such as 802.11s mesh Wi-Fi nodes. Hosts that do not use mesh Wi-Fi are unlikely to be exposed. The sources do not say which kernel versions are fixed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: account proxy paths against the mesh path limit
Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH_MAX_MPATHS.
mesh_path_free_rcu() decrements the interface mpaths counter for entries from both the mesh and proxy path tables, but mpp_path_add() never reserves a slot in that counter. Removing or expiring a proxy path therefore returns a slot that was never charged.
mesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once it falls below the number of installed paths the limit no longer holds.
Reserve the shared quota before allocating a proxy path and release it on every unsuccessful addition. Mesh and proxy paths now share one 1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit.
This page as .md · .json · in your agent: get_signal("CVE-2026-98705")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.