{"id":"CVE-2026-98705","kind":"vulnerability","aliases":["CVE-2026-98705"],"related":[],"title":"Linux kernel: mesh Wi-Fi proxy paths can exceed the path limit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: account proxy paths against the mesh path limit\n\nProxy-path churn can drive the interface path counter negative and let\nlater mesh path additions exceed MESH_MAX_MPATHS.\n\nmesh_path_free_rcu() decrements the interface mpaths counter for entries\nfrom both the mesh and proxy path tables, but mpp_path_add() never\nreserves a slot in that counter. Removing or expiring a proxy path\ntherefore returns a slot that was never charged.\n\nmesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once\nit falls below the number of installed paths the limit no longer holds.\n\nReserve the shared quota before allocating a proxy path and release it on\nevery unsuccessful addition. Mesh and proxy paths now share one\n1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit.","summary":"A flaw in the Linux kernel's mac80211 mesh Wi-Fi code lets proxy-path churn corrupt the counter that enforces the mesh path limit, so more paths than MESH_MAX_MPATHS can be installed. The sources do not state a direct code-execution or data-theft outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","mac80211","mesh-wifi","other"],"not_affected_if":["no-mesh-wifi"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:48+00:00","updated_at":"2026-10-25T05:18:48+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T05:18:48Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Linux kernel: mesh Wi-Fi proxy paths can exceed the path limit","impact":"low","summary":"A flaw in the Linux kernel's mac80211 mesh Wi-Fi code lets proxy-path churn corrupt the counter that enforces the mesh path limit, so more paths than MESH_MAX_MPATHS can be installed. The sources do not state a direct code-execution or data-theft outcome.","category":"other","nicknames":[],"who_cares":["linux-kernel","mesh-wifi","mac80211"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; mesh path limit can be exceeded, resource exhaustion likely","analyst_note":"Check the upstream kernel commit and NVD entry for affected and fixed kernel versions, and whether an attacker needs to be a mesh peer.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-mesh-wifi"],"who_is_affected":"Systems running Linux kernels with mac80211 mesh networking enabled, such as 802.11s mesh Wi-Fi nodes. Hosts that do not use mesh Wi-Fi are unlikely to be exposed. The sources do not say which kernel versions are fixed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3532,"output_tokens":496,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98705':16A,19A '1024':214C 'account':91C 'add':142C,166C,220C 'addit':115C,206C 'alloc':196C 'budget':216C 'charg':163C 'churn':44B,102C 'code':39B,72B 'code-execut':71B 'corrupt':45B 'counter':47B,108C,128C,149C,170C 'cve':14A,17A 'data':76B 'data-theft':75B 'decrement':124C 'direct':70B 'drive':104C 'enforc':49B,172C 'enospc':223C 'entri':130C,215C 'everi':204C 'exceed':10A,116C 'execut':73B 'expir':152C 'fall':179C 'fi':6A,38B 'flaw':28B 'follow':84C 'free':122C 'hold':190C 'instal':63B,184C 'interfac':106C,126C 'kernel':2A,22B,32B,82C 'later':112C 'let':40B,111C 'limit':13A,53B,98C,187C,226C 'linux':1A,21B,31B,81C 'linux-kernel':20B 'longer':189C 'mac80211':23B,34B,90C 'max':59B,118C,174C 'mesh':3A,25B,35B,51B,58B,96C,113C,117C,120C,134C,164C,173C,207C 'mesh-wifi':24B 'mpath':60B,119C,127C,175C 'mpp':140C,218C 'negat':109C 'never':143C,162C 'number':182C 'one':213C 'outcom':78B 'path':8A,12A,43B,52B,56B,93C,97C,101C,107C,114C,121C,137C,141C,155C,165C,185C,199C,210C,219C 'proxi':7A,42B,92C,100C,136C,154C,198C,209C 'proxy-path':41B,99C 'quota':194C 'rcu':123C 'releas':201C 'remov':150C 'reserv':144C,191C 'resolv':88C 'return':157C,222C 'share':193C,212C 'slot':146C,159C 'sourc':65B 'state':68B 'tabl':138C 'theft':77B 'therefor':156C 'unsuccess':205C 'use':167C 'vulner':85C 'wi':5A,37B 'wi-fi':4A,36B 'wifi':26B,89C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with mac80211 mesh networking enabled, such as 802.11s mesh Wi-Fi nodes. Hosts that do not use mesh Wi-Fi are unlikely to be exposed. The sources do not say which kernel versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98705","severity":null,"published_at":"2026-10-18T16:17:24+00:00","modified_at":"2026-10-21T13:21:38+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}