CVE-2026-98699
Received Received - Intake

Use-After-Free in Linux Kernel WiFi Mesh Fast Xmit

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion flushes the cache and then frees the path with kfree_rcu(), but a lookup that already holds the path can insert a new cache entry after the flush. The cache then points at freed memory. Set MESH_PATH_DELETED before flushing, and skip inserting a cache entry if the path or MPP path is already deleted. Check this under the cache walk lock so it is ordered with the flush. Use WRITE_ONCE() for the deletion flag updates because the cache check reads flags without taking state_lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98699
EUVD
EUVD-2026-103953

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux d5edb9ae8d568745f893c5c5fa3837d85311b131
Linux Linux d5edb9ae8d568745f893c5c5fa3837d85311b131
Linux Linux d5edb9ae8d568745f893c5c5fa3837d85311b131
Linux Linux d5edb9ae8d568745f893c5c5fa3837d85311b131
Linux Linux 6.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's WiFi mesh networking subsystem. It occurs in the mesh_fast_tx_cache() function where raw mesh_path pointers are stored. When a path is deleted, the cache is flushed and the path is freed with kfree_rcu(). However, a concurrent lookup that already holds the path can reinsert a cache entry after the flush, causing the cache to point to freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 mesh networking subsystem and involves a use-after-free condition in the mesh fast xmit path. Detection requires checking kernel logs for mesh path deletion errors or crashes related to mesh_fast_tx_cache(). Monitor system logs for kernel oops or panics involving mac80211 or mesh functionality. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or potential privilege escalation if exploited. It specifically affects systems using Linux kernel WiFi mesh networking features.

Mitigation Strategies

Apply the kernel patch that resolves this issue by updating to a version containing the fix for mesh_fast_tx_cache() and MESH_PATH_DELETED flag handling. If immediate patching is not possible, disable mesh networking features temporarily until the patch is applied to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart