CVE-2026-98705
wifi: mac80211: account proxy paths against the mesh path limit
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH_MAX_MPATHS. mesh_path_free_rcu() decrements the interface mpaths counter for entries from both the mesh and proxy path tables, but mpp_path_add() never reserves a slot in that counter. Removing or expiring a proxy path therefore returns a slot that was never charged. mesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once it falls below the number of installed paths the limit no longer holds. Reserve the shared quota before allocating a proxy path and release it on every unsuccessful addition. Mesh and proxy paths now share one 1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit.
Timeline
ID reserved
By Linux
- 23 days later
· 23 days later
Published
- 12 days later
· 12 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 89% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < 0e79c9d260862bd4676955d3cac7baa0d38a5b2e
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < bfd447ee32f727e535e317aa5a8447488f943803
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < 7f83dab0045f756a82a15ac751165aefa03bed11
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < c66ab4b94bb04c162485759196555e08c0965320
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < df072db65fdaa34ad15e1d66fc06a53e3e97f778
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < 3b75831ceee76d32bb8e7ddd241904f92f9b5407
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < 5a32409ed34a1868830899a5d2437f0b3bf3532c
- affected ece1a2e7e86078c8379937b546e32cb7f25fcb6c – < a5f35d4b112af1415ff06bd501c8cc26cc08aa8b
- affected 3.2
- unaffected < 3.2
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.113 – ≤ 6.12.*
- unaffected 6.18.56 – ≤ 6.18.*
- unaffected 7.2.10 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References (8)
- https://git.kernel.org/stable/c/0e79c9d260862bd4676955d3cac7baa0d38a5b2e (opens in a new tab)
- https://git.kernel.org/stable/c/bfd447ee32f727e535e317aa5a8447488f943803 (opens in a new tab)
- https://git.kernel.org/stable/c/7f83dab0045f756a82a15ac751165aefa03bed11 (opens in a new tab)
- https://git.kernel.org/stable/c/c66ab4b94bb04c162485759196555e08c0965320 (opens in a new tab)
- https://git.kernel.org/stable/c/df072db65fdaa34ad15e1d66fc06a53e3e97f778 (opens in a new tab)
- https://git.kernel.org/stable/c/3b75831ceee76d32bb8e7ddd241904f92f9b5407 (opens in a new tab)
- https://git.kernel.org/stable/c/5a32409ed34a1868830899a5d2437f0b3bf3532c (opens in a new tab)
- https://git.kernel.org/stable/c/a5f35d4b112af1415ff06bd501c8cc26cc08aa8b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98705)Record last updated .