CVE-2026-98701wifi: mac80211: release mesh path quota on failed additions
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from being created. mesh_path_add() reserves a slot before allocating and inserting a path. If allocation fails, the function returns without releasing the slot. If the rhashtable insertion reports an error or an existing destination, the function discards its candidate but retains the reservation. No new path is installed in any of these cases. Release the reservation whenever the candidate is not installed.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from ae76eef027f75fadd8a8eda55ee07707f077aacb before 56691ed9ef792f180e008a43294a4dc059fbeca2; from ae76eef027f75fadd8a8eda55ee07707f077aacb before a613c891906b558c10a4fa98ca29747b98e857cb; from ae76eef027f75fadd8a8eda55ee07707f077aacb before a59eca4557c7462aad1b160011013290a92de97d; from ae76eef027f75fadd8a8eda55ee07707f077aacb before 7325a44474f20c1393a1c114c6811abce6ddfaf4 | CNA record |
References
- https://git.kernel.org/stable/c/56691ed9ef792f180e008a43294a4dc059fbeca2
- https://git.kernel.org/stable/c/a613c891906b558c10a4fa98ca29747b98e857cb
- https://git.kernel.org/stable/c/a59eca4557c7462aad1b160011013290a92de97d
- https://git.kernel.org/stable/c/7325a44474f20c1393a1c114c6811abce6ddfaf4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.