CVE-2026-98699wifi: mac80211: fix mesh fast xmit path deletion UAF
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion flushes the cache and then frees the path with kfree_rcu(), but a lookup that already holds the path can insert a new cache entry after the flush. The cache then points at freed memory. Set MESH_PATH_DELETED before flushing, and skip inserting a cache entry if the path or MPP path is already deleted. Check this under the cache walk lock so it is ordered with the flush. Use WRITE_ONCE() for the deletion flag updates because the cache check reads flags without taking state_lock.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from d5edb9ae8d568745f893c5c5fa3837d85311b131 before 0117f1aa189495e6f1ff608681678817995aee39; from d5edb9ae8d568745f893c5c5fa3837d85311b131 before 128e800a41270ab197b1cc8043637a2924865608; from d5edb9ae8d568745f893c5c5fa3837d85311b131 before 93da3ec938bfdcfb3899428f04c6d0c56fe32952; from d5edb9ae8d568745f893c5c5fa3837d85311b131 before ee3aadc43ea69d98f666431e787137ac0badbb85 | CNA record |
References
- https://git.kernel.org/stable/c/0117f1aa189495e6f1ff608681678817995aee39
- https://git.kernel.org/stable/c/128e800a41270ab197b1cc8043637a2924865608
- https://git.kernel.org/stable/c/93da3ec938bfdcfb3899428f04c6d0c56fe32952
- https://git.kernel.org/stable/c/ee3aadc43ea69d98f666431e787137ac0badbb85
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.