CVE-2026-98705 Overview
CVE-2026-98705 is a resource accounting flaw in the Linux kernel mac80211 subsystem affecting wireless mesh networking. The vulnerability stems from inconsistent accounting of proxy paths against the shared mesh path counter. The function mesh_path_free_rcu() decrements the interface mpaths counter for both mesh and proxy table entries, but mpp_path_add() never reserves a slot in that counter. Repeated proxy path churn drives the counter negative, which allows later mesh path additions to exceed the MESH_MAX_MPATHS limit of 1024 entries. The flaw enables unbounded resource consumption in kernel memory tied to mesh interface state.
Critical Impact
Attackers within wireless range of a mesh interface can bypass the MESH_MAX_MPATHS limit, exhausting kernel memory and degrading or denying service on affected systems.
Affected Products
- Linux kernel mac80211 wireless subsystem
- Systems running mesh-mode wireless interfaces (IEEE 802.11s)
- Distributions shipping kernels prior to the fix commits referenced below
Discovery Timeline
- 2026-10-18 - CVE-2026-98705 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98705
Vulnerability Analysis
The Linux mac80211 mesh implementation maintains two path tables: a mesh path table for direct mesh peers and a proxy path table (mpp) for proxied destinations outside the mesh. Both tables share a per-interface counter used to enforce the MESH_MAX_MPATHS cap. The accounting asymmetry introduces a counter-integrity defect classified under improper resource shutdown and release behavior.
When a proxy path is added through mpp_path_add(), no quota is reserved against the shared counter. When any path from either table is freed through mesh_path_free_rcu(), the counter is decremented regardless of origin. Each proxy addition and subsequent removal therefore returns a slot that was never charged, driving the counter below zero over time.
mesh_path_add() consults the same counter to enforce the maximum. Once the counter drifts below the number of installed paths, the limit no longer applies. Attackers can then install mesh paths beyond the 1024-entry budget, consuming kernel slab memory and routing structures.
Root Cause
The root cause is an asymmetric accounting path between allocation and deallocation. Proxy path creation skips the counter increment, while deallocation decrements it unconditionally. The fix reserves the shared quota before allocating a proxy path and releases it on every unsuccessful addition. Mesh and proxy paths now share a single 1024-entry budget, and mpp_path_add() returns -ENOSPC once the budget is exhausted.
Attack Vector
An attacker on an adjacent mesh network can trigger repeated proxy path churn through crafted mesh frames that cause proxy entries to be added and expired. Each cycle leaks a counter slot. After sufficient churn, the attacker transitions to flooding mesh path requests that exceed the intended maximum, exhausting kernel memory and causing performance degradation or denial of service.
Technical details are available in the upstream fix commits: Kernel Git Commit 3b75831c, Kernel Git Commit 5a32409e, Kernel Git Commit a5f35d4b, Kernel Git Commit c66ab4b9, and Kernel Git Commit df072db6.
Detection Methods for CVE-2026-98705
Indicators of Compromise
- Mesh interfaces showing path counts above 1024 entries when inspected through iw dev <iface> mpath dump.
- Elevated kernel slab consumption attributable to mac80211 mesh path allocations without a corresponding increase in legitimate peers.
- Repeated proxy path add and expire events in kernel ring buffer logs on mesh-enabled interfaces.
Detection Strategies
- Monitor kernel memory usage of mac80211 structures over time using slabtop and alert on sustained growth tied to mesh path objects.
- Audit kernel versions across wireless infrastructure and flag hosts missing the referenced stable backports.
- Correlate wireless mesh frame volume with path-table size to identify churn-driven anomalies.
Monitoring Recommendations
- Collect dmesg output and systemd journal entries from wireless hosts into a centralized log pipeline for anomaly review.
- Track per-interface mesh path counts as a time-series metric and alert on values approaching or exceeding MESH_MAX_MPATHS.
- Baseline normal mesh peer and proxy counts for each site to detect sudden excursions.
How to Mitigate CVE-2026-98705
Immediate Actions Required
- Inventory all Linux systems using mac80211 mesh mode and prioritize them for kernel updates.
- Apply vendor-supplied kernel updates that incorporate the upstream fix commits as soon as they are available.
- Restrict mesh interfaces to trusted operating areas and reduce exposure to untrusted wireless peers.
Patch Information
The fix is distributed across the following upstream commits: Kernel Git Commit 3b75831c, Kernel Git Commit 5a32409e, Kernel Git Commit a5f35d4b, Kernel Git Commit c66ab4b9, and Kernel Git Commit df072db6. Patched kernels charge the shared quota before allocating a proxy path and release it on failed additions. mpp_path_add() returns -ENOSPC when the 1024-entry budget is reached.
Workarounds
- Disable mesh mode on wireless interfaces that do not require it until patched kernels are deployed.
- Place mesh-enabled devices on isolated network segments to limit the pool of potential attackers.
- Monitor and periodically restart affected interfaces to clear accumulated counter drift as a short-term containment measure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
