CVE-2026-98699: Linux Kernel Mesh Fast Xmit UAF Vulnerability

CVE-2026-98699 Overview

CVE-2026-98699 is a use-after-free (UAF) vulnerability in the Linux kernel's mac80211 wireless subsystem. The flaw resides in the mesh fast transmit path, specifically in how mesh_fast_tx_cache() stores raw mesh_path pointers. When a mesh path is deleted, the cache is flushed and the path is freed via kfree_rcu(). A concurrent lookup already holding the path can insert a new cache entry after the flush, leaving the cache pointing at freed memory. Subsequent transmit operations may then dereference the freed mesh_path object, leading to kernel memory corruption.

Critical Impact
A race condition between mesh path deletion and cache insertion can corrupt kernel memory on systems using 802.11s wireless mesh networking, potentially enabling local privilege escalation or kernel crashes.

Affected Products

Linux kernel versions containing the mesh_fast_tx_cache() implementation in net/mac80211
Distributions shipping affected stable kernels with 802.11s mesh support enabled
Wireless drivers and devices utilizing the mac80211 mesh fast xmit path

Discovery Timeline

2026-10-18 - CVE-2026-98699 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98699

Vulnerability Analysis

The vulnerability is a use-after-free in the mesh fast transmit cache path of mac80211. The function mesh_fast_tx_cache() caches raw pointers to mesh_path structures to accelerate transmission in 802.11s wireless mesh networks. Path deletion follows a two-step pattern: flush all cache entries referencing the path, then free the path with kfree_rcu(). The race window exists because a concurrent lookup can obtain a reference to the path before deletion begins, then insert a cache entry after the flush has already completed. The cache then holds a dangling pointer to memory scheduled for release.

Root Cause

The root cause is missing synchronization between path deletion and cache insertion. The deletion routine did not mark the path as deleted before flushing the cache, and cache insertion did not check whether the path or MPP (Mesh Proxy Path) was already pending removal. The lookup and insert paths read state without holding state_lock, so even a naive flag check would race with the deletion flow.

Attack Vector

Triggering the race requires a Linux system acting as an 802.11s mesh node with active transmit traffic. An attacker on the same wireless mesh, or a local user capable of inducing rapid mesh path churn, can drive concurrent lookups and deletions to open the race window. Successful exploitation results in dereferencing freed kernel memory, which can produce a denial of service through kernel panic or, with heap grooming, pave the way for privilege escalation.

The upstream fix sets MESH_PATH_DELETED before flushing the cache and skips cache entry insertion when the path or MPP path is already marked deleted. The deletion flag check runs under the cache walk lock to order it with the flush, and WRITE_ONCE() is used for flag updates because the cache insertion path reads the flag without taking state_lock. See the kernel commits 0117f1a, 128e800, 93da3ec, ebb7cba, and ee3aadc for the complete patch set.

Detection Methods for CVE-2026-98699

Indicators of Compromise

Kernel oops or panic traces referencing mesh_fast_tx_cache, mesh_path_del, or ieee80211_xmit in the call stack.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in net/mac80211/mesh_pathtbl.c or tx.c on mesh-enabled hosts.
Unexpected wireless interface resets or mesh connectivity drops on systems running 802.11s workloads.

Detection Strategies

Enumerate running kernel versions across the fleet and correlate against the fixed stable kernel commits listed in the NVD references.
Enable KASAN on test or canary hosts running mesh workloads to surface the race during QA cycles.
Monitor dmesg and the system journal for mac80211 warnings tied to mesh path tables.

Monitoring Recommendations

Forward kernel log events to a central SIEM or data lake and alert on crash signatures that include mac80211 or mesh_path symbols.
Track wireless driver and CONFIG_MAC80211_MESH usage inventory to scope exposure.
Baseline mesh node uptime and investigate anomalous reboot clusters that correlate with mesh traffic peaks.

How to Mitigate CVE-2026-98699

Immediate Actions Required

Update to a Linux stable kernel that includes commits 0117f1a, 128e800, 93da3ec, ebb7cba, or ee3aadc.
Prioritize patching hosts configured as 802.11s mesh nodes or using wireless drivers that enable the mesh fast xmit path.
Restrict physical and network proximity to mesh-enabled devices until patches are deployed.

Patch Information

The fix is distributed across multiple Linux stable branches. The relevant upstream commits are 0117f1a, 128e800, 93da3ec, ebb7cba, and ee3aadc. Apply the vendor-supplied kernel package that incorporates these changes rather than cherry-picking manually in production.

Workarounds

Disable 802.11s mesh functionality where it is not required, either by unloading mesh-capable wireless modules or by not configuring type mesh interfaces via iw.
Avoid loading the mac80211 subsystem on servers that do not require wireless networking.
Limit which users can create or tear down mesh interfaces by restricting CAP_NET_ADMIN through standard capability controls.

bash

# Verify running kernel version and mesh interface presence
uname -r
iw dev | grep -E 'Interface|type'

# Remove mesh interfaces that are not required
sudo iw dev mesh0 del

# Optionally blacklist mac80211 on systems without wireless requirements
echo 'blacklist mac80211' | sudo tee /etc/modprobe.d/disable-mac80211.conf
sudo update-initramfs -u