CVE-2026-98705: wifi: mac80211: account proxy paths against the mesh path limit

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: account proxy paths against the mesh path limit

Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS.

meshpathfreercu() decrements the interface mpaths counter for entries from both the mesh and proxy path tables, but mpppathadd() never reserves a slot in that counter. Removing or expiring a proxy path therefore returns a slot that was never charged.

meshpathadd() uses the same counter to enforce MESHMAXMPATHS, so once it falls below the number of installed paths the limit no longer holds.

Reserve the shared quota before allocating a proxy path and release it on every unsuccessful addition. Mesh and proxy paths now share one 1024-entry budget, so mpppathadd() can return -ENOSPC at that limit.