CVE-2026-98705

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: account proxy paths against the mesh path limit

Proxy-path churn can drive the interface path counter negative and let

later mesh path additions exceed MESH_MAX_MPATHS.

mesh_path_free_rcu() decrements the interface mpaths counter for entries

from both the mesh and proxy path tables, but mpp_path_add() never

reserves a slot in that counter. Removing or expiring a proxy path

therefore returns a slot that was never charged.

mesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once

it falls below the number of installed paths the limit no longer holds.

Reserve the shared quota before allocating a proxy path and release it on

every unsuccessful addition. Mesh and proxy paths now share one

1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References