CVE-2026-98705
Received Received - Intake

Wi-Fi Mesh Path Limit Bypass in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH_MAX_MPATHS. mesh_path_free_rcu() decrements the interface mpaths counter for entries from both the mesh and proxy path tables, but mpp_path_add() never reserves a slot in that counter. Removing or expiring a proxy path therefore returns a slot that was never charged. mesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once it falls below the number of installed paths the limit no longer holds. Reserve the shared quota before allocating a proxy path and release it on every unsuccessful addition. Mesh and proxy paths now share one 1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98705
EUVD
EUVD-2026-103959

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux ece1a2e7e86078c8379937b546e32cb7f25fcb6c
Linux Linux ece1a2e7e86078c8379937b546e32cb7f25fcb6c
Linux Linux ece1a2e7e86078c8379937b546e32cb7f25fcb6c
Linux Linux ece1a2e7e86078c8379937b546e32cb7f25fcb6c
Linux Linux 3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the wifi subsystem's mesh networking feature. A flaw in how proxy paths are accounted for allows the path counter to go negative, enabling more mesh paths to be added than the system's limit (MESH_MAX_MPATHS). This happens because proxy paths are not properly reserving slots in the shared counter used to enforce the limit.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and mesh networking. Detection requires checking kernel logs for mesh path-related errors or examining the mesh path table size. Commands like dmesg | grep mesh or checking /proc/net/mesh may help identify abnormal path counts. Ensure your kernel version is updated to a patched release.

Impact Analysis

An attacker could exploit this to cause a denial of service by overwhelming the mesh networking subsystem, leading to system instability or crashes. It may also allow unauthorized network access if mesh path limits are bypassed.

Mitigation Strategies

Update the Linux kernel to a version containing the fix for this issue. Avoid using mesh networking features until patched. Monitor system logs for mesh path errors. If mesh networking is critical, consider disabling proxy paths or limiting mesh path usage until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98705. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart