CVE-2026-98701 Overview
CVE-2026-98701 is a resource exhaustion vulnerability in the Linux kernel's mac80211 wireless subsystem. The flaw affects mesh path handling in the mesh_path_add() function. Repeated failed or duplicate mesh path additions can exhaust the MESH_MAX_MPATHS quota while the path table itself holds fewer paths. This condition prevents new mesh paths to reachable destinations from being created, degrading mesh network connectivity.
Critical Impact
Mesh networks running on affected Linux kernels can lose the ability to establish paths to reachable destinations, resulting in denial of service for wireless mesh connectivity.
Affected Products
- Linux kernel wireless mac80211 subsystem
- Systems operating as IEEE 802.11s wireless mesh nodes
- Linux distributions shipping affected stable kernel branches
Discovery Timeline
- 2026-10-18 - CVE-2026-98701 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98701
Vulnerability Analysis
The vulnerability resides in the mesh path management code of the mac80211 wireless subsystem. The mesh_path_add() function reserves a slot in the mesh path table before allocating memory and inserting the candidate path. The reservation counter tracks against the MESH_MAX_MPATHS global limit on mesh paths per interface.
When memory allocation fails, the function returns without releasing the previously reserved slot. When the rhashtable insertion reports an error or detects an existing destination, the function discards its candidate but keeps the reservation held. No new mesh path is installed in any of these failure paths, yet the quota continues to decrement toward exhaustion.
Over time, repeated failures accumulate stale reservations. The quota counter reaches MESH_MAX_MPATHS while the actual path table contains far fewer entries. Subsequent legitimate path creation requests to reachable mesh destinations are rejected, breaking routing within the mesh.
Root Cause
The root cause is improper resource accounting in the error paths of mesh_path_add(). The function reserves quota eagerly but does not release that reservation when the candidate path fails to install, resulting in a resource leak counted against MESH_MAX_MPATHS.
Attack Vector
Exploitation requires conditions that trigger repeated failed or duplicate mesh path additions. These can arise from adversarial mesh peers, high memory pressure causing allocation failures, or workloads that repeatedly request paths to duplicate destinations. The result is a denial of service limited to mesh wireless functionality. See the Linux Kernel Commit a613c89 for the fix that releases the reservation when the candidate is not installed.
Detection Methods for CVE-2026-98701
Indicators of Compromise
- Mesh interfaces returning path-creation errors despite the mesh path table showing fewer entries than MESH_MAX_MPATHS.
- Loss of connectivity to known-reachable mesh destinations without corresponding link-layer failures.
- Elevated rates of mesh path add failures or rhashtable insert errors in kernel logs.
Detection Strategies
- Compare running kernel version against the fixed commits referenced in the stable tree advisories.
- Monitor mesh path table occupancy using iw tooling and correlate against observed path-add failures.
- Collect kernel ring buffer messages from mac80211 for repeated path allocation or insertion failures.
Monitoring Recommendations
- Instrument wireless mesh nodes to export mesh path counts and failure rates to centralized logging.
- Alert when path-add failures persist against destinations confirmed reachable at the link layer.
- Track kernel version inventory across fleets of mesh-capable Linux devices to prioritize patching.
How to Mitigate CVE-2026-98701
Immediate Actions Required
- Identify Linux systems that use the mac80211 subsystem in IEEE 802.11s mesh mode.
- Apply the stable kernel update containing the fix that releases the reservation on failed insertions.
- Reboot affected systems to activate the patched kernel, as the fix lives in loaded kernel code.
Patch Information
The fix releases the reserved mesh path slot whenever the candidate is not installed. Patches have been merged across multiple stable branches. See the following references: Linux Kernel Commit 56691ed, Linux Kernel Commit 57bfaa8, Linux Kernel Commit 7325a44, Linux Kernel Commit a59eca4, and Linux Kernel Commit a613c89.
Workarounds
- Disable mesh mode on wireless interfaces where mesh networking is not required.
- Restart affected mesh interfaces to clear accumulated stale reservations as a temporary measure until patching.
- Restrict peer associations on mesh nodes to trusted devices to reduce adversarial path-add attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
