CVE-2026-98705: wifi: mac80211: account proxy paths against the mesh path limit
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: account proxy paths against the mesh path limit
Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS.
meshpathfreercu() decrements the interface mpaths counter for entries from both the mesh and proxy path tables, but mpppathadd() never reserves a slot in that counter. Removing or expiring a proxy path therefore returns a slot that was never charged.
meshpathadd() uses the same counter to enforce MESHMAXMPATHS, so once it falls below the number of installed paths the limit no longer holds.
Reserve the shared quota before allocating a proxy path and release it on every unsuccessful addition. Mesh and proxy paths now share one 1024-entry budget, so mpppathadd() can return -ENOSPC at that limit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
Which deployments are relevant to this issue?
The issue applies to Linux kernel mac80211 mesh interfaces that use both mesh paths and proxy paths. The provided information does not establish whether any particular default configuration enables or uses these paths.
What limit applies after the fix?
Mesh paths and proxy paths share a single budget of 1024 entries. When that shared limit is reached, proxy-path addition can fail with -ENOSPC.
What condition is required for the limit to be bypassed in affected code?
Proxy paths must be removed or expire after being added without reserving space in the shared interface path counter. This can drive the counter below the number of installed paths, allowing later mesh-path additions beyond the intended limit.