CVE-2026-98701 (GCVE-0-2026-98701)
Vulnerability from cvelistv5
Published
2026-10-18 15:46
Modified
2026-10-21 12:55
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from being created. mesh_path_add() reserves a slot before allocating and inserting a path. If allocation fails, the function returns without releasing the slot. If the rhashtable insertion reports an error or an existing destination, the function discards its candidate but retains the reservation. No new path is installed in any of these cases. Release the reservation whenever the candidate is not installed.
References
Impacted products
Vendor Product Version
Linux Linux Version: ae76eef027f75fadd8a8eda55ee07707f077aacb
Version: ae76eef027f75fadd8a8eda55ee07707f077aacb
Version: ae76eef027f75fadd8a8eda55ee07707f077aacb
Version: ae76eef027f75fadd8a8eda55ee07707f077aacb
Version: ae76eef027f75fadd8a8eda55ee07707f077aacb
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mesh_pathtbl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57bfaa8b2853425ab1b83114d823a62fe63f859f",
              "status": "affected",
              "version": "ae76eef027f75fadd8a8eda55ee07707f077aacb",
              "versionType": "git"
            },
            {
              "lessThan": "56691ed9ef792f180e008a43294a4dc059fbeca2",
              "status": "affected",
              "version": "ae76eef027f75fadd8a8eda55ee07707f077aacb",
              "versionType": "git"
            },
            {
              "lessThan": "a613c891906b558c10a4fa98ca29747b98e857cb",
              "status": "affected",
              "version": "ae76eef027f75fadd8a8eda55ee07707f077aacb",
              "versionType": "git"
            },
            {
              "lessThan": "a59eca4557c7462aad1b160011013290a92de97d",
              "status": "affected",
              "version": "ae76eef027f75fadd8a8eda55ee07707f077aacb",
              "versionType": "git"
            },
            {
              "lessThan": "7325a44474f20c1393a1c114c6811abce6ddfaf4",
              "status": "affected",
              "version": "ae76eef027f75fadd8a8eda55ee07707f077aacb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mesh_pathtbl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: release mesh path quota on failed additions\n\nRepeated failed or duplicate mesh path additions can exhaust\nMESH_MAX_MPATHS while the path table holds fewer paths, which stops new\npaths to reachable destinations from being created.\n\nmesh_path_add() reserves a slot before allocating and inserting a path.\nIf allocation fails, the function returns without releasing the slot. If\nthe rhashtable insertion reports an error or an existing destination, the\nfunction discards its candidate but retains the reservation. No new path\nis installed in any of these cases.\n\nRelease the reservation whenever the candidate is not installed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:55:50.930Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/57bfaa8b2853425ab1b83114d823a62fe63f859f"
        },
        {
          "url": "https://git.kernel.org/stable/c/56691ed9ef792f180e008a43294a4dc059fbeca2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a613c891906b558c10a4fa98ca29747b98e857cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a59eca4557c7462aad1b160011013290a92de97d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7325a44474f20c1393a1c114c6811abce6ddfaf4"
        }
      ],
      "title": "wifi: mac80211: release mesh path quota on failed additions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98701",
    "datePublished": "2026-10-18T15:46:31.257Z",
    "dateReserved": "2026-09-25T10:25:14.365Z",
    "dateUpdated": "2026-10-21T12:55:50.930Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.