Cloudanix VulnDB

CVE-2026-98327

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux wireless mesh networking can leak small amounts of kernel memory whenever a device leaves a network while changing channels, eventually using up resources on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory and state leak in mac80211 mesh CSA handling: ifmsh->csa allocation in ieee80211_mesh_csa_beacon is only freed in ieee80211_mesh_finish_csa; leaving the mesh during a pending channel switch also leaks csa_role and chsw_ttl state.

Why it matters to the business

Gradual kernel memory exhaustion on systems running mesh Wi-Fi, potential state corruption in mesh interfaces, and increased operational risk for wireless access points or embedded devices that use Linux kernel mesh networking.

How an attack unfolds

An attacker with the ability to influence mesh interface state (for example via crafted management frames or local control of a mesh peer) triggers a channel switch announcement, then forces the local interface to leave the mesh before the switch completes, causing the kernel to leak the allocated CSA structures.

How to fix it

Upgrade to a Linux kernel containing the fix that refactors CSA reset logic and invokes it from ieee80211_stop_mesh; apply the patch that ensures csa, csa_role, and chsw_ttl are always cleared on mesh stop.

How to confirm the fix worked

Confirm the presence of the reset call inside ieee80211_stop_mesh and the absence of the leak paths in ieee80211_mesh_csa_beacon / ieee80211_mesh_finish_csa; test by starting a mesh CSA then immediately stopping the mesh and verifying no orphaned allocations remain.

Typical attack path

  1. Establish or join a mesh network on a vulnerable Linux system
  2. Trigger or observe a pending CSA via beacon or action frame
  3. Cause ieee80211_stop_mesh to be called while the switch is still pending
  4. Repeat to accumulate leaks and exhaust memory or corrupt mesh state

How to detect it

Review kernel logs for repeated mesh CSA allocation warnings or slab cache growth; inspect wireless interface teardown sequences for missing CSA cleanup; correlate mesh stop events with memory pressure indicators.

What your security team should do

  • Prioritize kernel updates on all systems exposing mesh Wi-Fi interfaces
  • Monitor memory usage on wireless mesh nodes for unexplained growth
  • Disable mesh functionality where not required until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes. Leaving the mesh while a switch is still pending therefore leaks it. Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak in this case, so things can get mixed up in addition to the memory leak. Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.

Affected packages

Ecosystem Package Introduced Fixed