CVE-2026-98701: wifi: mac80211: release mesh path quota on failed additions
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: release mesh path quota on failed additions
Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from being created.
meshpathadd() reserves a slot before allocating and inserting a path. If allocation fails, the function returns without releasing the slot. If the rhashtable insertion reports an error or an existing destination, the function discards its candidate but retains the reservation. No new path is installed in any of these cases.
Release the reservation whenever the candidate is not installed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What systems are exposed to this condition?
Systems using the Linux kernel's mac80211 mesh functionality are exposed when failed or duplicate mesh path additions occur. The issue affects mesh path capacity accounting rather than systems that do not use this functionality.
What conditions are needed to trigger the issue?
Mesh path additions must repeatedly fail during allocation or be rejected by rhashtable insertion, including attempts for an already existing destination. Each unsuccessful candidate can retain a reserved mesh-path slot even though no path is installed.
What is the operational impact?
The reserved-slot count can reach MESH_MAX_MPATHS while the actual path table contains fewer paths. At that point, the system cannot create new mesh paths to reachable destinations.
How can administrators identify an affected state?
An affected state is indicated when new mesh paths cannot be created because the mesh path quota is exhausted, despite the path table holding fewer than MESH_MAX_MPATHS entries. Failed allocation, insertion-error, or duplicate-addition events are the relevant preceding conditions.