CVE-2026-98327 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: mesh: reset the CSA state when leaving
ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes. Leaving the mesh while a switch is still pending therefore leaks it.
Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak in this case, so things can get mixed up in addition to the memory leak.
Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified vulnerability resides within the Linux kernel's mac80211 subsystem, specifically affecting the mesh networking implementation for wireless interfaces. This issue manifests as a resource leak involving memory allocation and state management during channel switch operations in IEEE 802.11s mesh networks. The core of the problem lies in the lifecycle management of the Channel Switch Announcement (CSA) context structure, referenced by ifmsh->csa. Under normal operational flow, this structure is allocated within the ieee80211_mesh_csa_beacon function when a channel switch announcement is initiated and transmitted to peer nodes. The corresponding deallocation occurs exclusively in ieee80211_mesh_finish_csa, which is invoked only upon the successful completion of the channel switch process. This design assumes that the mesh interface will remain active until the transition concludes or fails gracefully through standard protocol mechanisms.
However, a critical flaw emerges when an administrator or system process decides to leave or disable the mesh network while a channel switch operation is still pending and has not yet completed. In such scenarios, the ieee80211_mesh_finish_csa function is bypassed because the termination of the interface occurs before the switch can finalize. Consequently, the memory allocated for ifmsh->csa remains unfreed, resulting in a direct kernel memory leak. Over time, repeated instances of this behavior on systems that frequently join and leave mesh networks or undergo frequent channel changes can lead to significant depletion of available kernel memory resources, potentially causing system instability or denial of service conditions due to resource exhaustion.
Beyond the immediate memory allocation issue, the vulnerability also involves a state inconsistency problem related to ifmsh->csa_role and ifmsh->chsw_ttl variables. These fields track the role of the node during the switch and the time-to-live for the channel switch process respectively. When the mesh is left prematurely without resetting these states, they retain values associated with the aborted operation. This stale state can cause logical errors in subsequent network operations, leading to mixed-up configurations or incorrect behavior when new management frames are processed. The lack of proper cleanup means that future attempts to initiate control functions may operate on corrupted context data, undermining the reliability and predictability of the mesh networking stack.
From a security classification perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective usage, commonly known as a memory leak. The improper state management also relates to CWE-665, improper initialization, as variables are left in an inconsistent state that does not reflect the actual operational status of the interface. In terms of attack vectors and tactical mapping within the MITRE ATT&CK framework for Enterprise or ICS, this issue falls under TA0004 Impact, specifically T1499 Endpoint Denial of Service via resource exhaustion. While typically requiring local access to trigger by manipulating network interfaces, it represents a reliability flaw that could be exploited in scenarios where an attacker has control over interface configuration commands to induce repeated leaks and degrade system performance.
The resolution involves refactoring the reset logic for CSA state variables into a centralized function that ensures all related resources are properly cleaned up regardless of how the mesh operation terminates. This corrected reset routine is then integrated into ieee80211_stop_mesh, which serves as the primary entry point when stopping or leaving the mesh network. By invoking this cleanup procedure during interface shutdown, the kernel guarantees that ifmsh->csa is freed and that csa_role and chsw_ttl are returned to their default neutral states. This change ensures robust resource management even in edge cases where administrative actions interrupt ongoing protocol procedures, thereby eliminating both the memory leak and the associated state corruption risks.
To mitigate this vulnerability on systems running affected kernel versions, administrators should apply the latest available security patches that include this mac80211 mesh fix. For environments unable to patch immediately due to stability concerns or long release cycles, operational mitigations involve avoiding abrupt termination of mesh interfaces while channel switch announcements are active. Monitoring system memory usage and dmesg logs for signs of kernel memory leaks can help detect early occurrences of the issue. Additionally, implementing strict access controls on network interface management commands reduces the risk of unauthorized users triggering premature mesh teardowns that could exacerbate resource exhaustion over time.