Cloudanix VulnDB

CVE-2026-98701

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux wireless mesh networking can let repeated failed connection attempts block all new routes, cutting off communication between devices that rely on the mesh.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failed or duplicate mesh path additions reserve quota slots under MESH_MAX_MPATHS without releasing them on allocation or insertion failure, exhausting the limit while the actual path table remains under capacity and blocks new reachable destinations.

Why it matters to the business

Mesh-based wireless networks can stop accepting new routes, causing connectivity loss for devices that rely on dynamic mesh paths and requiring manual intervention or restarts to restore service.

How an attack unfolds

An attacker with the ability to trigger repeated mesh path addition attempts (via malformed frames or repeated association attempts) causes quota exhaustion; once the limit is reached, legitimate mesh routes to reachable peers can no longer be installed, resulting in denial of service for mesh connectivity.

How to fix it

Apply the upstream kernel commit that releases the mesh path reservation on every failure path in mesh_path_add(); rebuild and deploy the patched kernel on all affected mesh-capable systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the mesh_path_add() function for an unconditional reservation release before every early return; test by triggering failure cases and verifying that MESH_MAX_MPATHS usage returns to the prior value.

Typical attack path

  1. Obtain network access or proximity to a mesh-enabled Linux device
  2. Send crafted or repeated mesh path addition requests that trigger allocation or rhashtable insertion failures
  3. Repeat until MESH_MAX_MPATHS quota is exhausted
  4. Observe that subsequent legitimate path additions are rejected, isolating reachable destinations

How to detect it

Review kernel logs for repeated mesh path allocation failures or quota exhaustion messages; correlate with mesh interface activity and check for processes or scripts that repeatedly attempt mesh path additions.

What your security team should do

  • Prioritize patching of any systems running mesh networking (802.11s) within the next maintenance window
  • Monitor kernel update channels for the backported fix in supported distributions
  • If mesh is not required, disable the mac80211 mesh functionality to reduce attack surface until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from being created. mesh_path_add() reserves a slot before allocating and inserting a path. If allocation fails, the function returns without releasing the slot. If the rhashtable insertion reports an error or an existing destination, the function discards its candidate but retains the reservation. No new path is installed in any of these cases. Release the reservation whenever the candidate is not installed.

Affected packages

Ecosystem Package Introduced Fixed