CVE-2026-98327wifi: mac80211: mesh: reset the CSA state when leaving
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes. Leaving the mesh while a switch is still pending therefore leaks it. Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak in this case, so things can get mixed up in addition to the memory leak. Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b8456a14e9d2770846fcf74de18ff95b676149a3 before aba8dfb45864441199748c33ce3c1c8ca121c8bd; from b8456a14e9d2770846fcf74de18ff95b676149a3 before bd3b21145ae2e781daac1bbd19216a63ab4e0cbd; from b8456a14e9d2770846fcf74de18ff95b676149a3 before ba5bf83a81e8832cb84bb3a2da67512f81f57a02; from b8456a14e9d2770846fcf74de18ff95b676149a3 before 860134b3af77970e006feab7e5decb8c84771c7f | CNA record |
References
- https://git.kernel.org/stable/c/aba8dfb45864441199748c33ce3c1c8ca121c8bd
- https://git.kernel.org/stable/c/bd3b21145ae2e781daac1bbd19216a63ab4e0cbd
- https://git.kernel.org/stable/c/ba5bf83a81e8832cb84bb3a2da67512f81f57a02
- https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.