CVE-2026-98705 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: account proxy paths against the mesh path limit
Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH_MAX_MPATHS.
mesh_path_free_rcu() decrements the interface mpaths counter for entries from both the mesh and proxy path tables, but mpp_path_add() never reserves a slot in that counter. Removing or expiring a proxy path therefore returns a slot that was never charged.
mesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once it falls below the number of installed paths the limit no longer holds.
Reserve the shared quota before allocating a proxy path and release it on every unsuccessful addition. Mesh and proxy paths now share one 1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel within the mac80211 wireless subsystem represents a critical resource management flaw related to mesh network path accounting. Specifically, this issue affects how proxy paths are handled relative to the global mesh path limit defined by MESH_MAX_MPATHS. In IEEE 802.11s mesh networks, nodes maintain routing information for both direct peer-to-peer connections and proxied routes that allow communication with non-directly connected neighbors. The kernel enforces a hard cap on the total number of active paths to prevent memory exhaustion and ensure system stability. However, the implementation failed to correctly synchronize the accounting logic between proxy path additions and the global counter used to enforce this limit. This discrepancy allows an attacker or a misbehaving network node to manipulate the internal state counters through specific sequence operations involving proxy path creation and deletion.
The technical root cause lies in an asymmetry between how slots are reserved for new paths versus how they are released upon expiration or removal. The function mesh_path_add() is responsible for enforcing the MESH_MAX_MPATHS limit by checking against a shared interface counter before allocating memory for a new mesh path entry. Conversely, when proxy paths are added via mpp_path_add(), no corresponding reservation was made against this same global counter. While the cleanup routine mesh_path_free_rcu() correctly decrements the interface mpaths counter regardless of whether the freed entry originated from the standard mesh table or the proxy path table, it assumes that every decrement corresponds to a prior increment. Because proxy paths were never charged against the limit during their creation, each removal operation effectively returns a slot that was never deducted in the first place. This logical error results in the interface mpaths counter becoming artificially inflated relative to the actual number of allocated structures, or potentially driving it negative if enough proxy paths are cycled through addition and deletion operations.
The operational impact of this vulnerability is significant for network stability and security. By allowing the path counter to drop below zero or become inconsistent with reality, an adversary can bypass the MESH_MAX_MPATHS restriction entirely. This enables the creation of a vast number of mesh and proxy paths that exceed the intended system limits. Such resource exhaustion can lead to kernel memory corruption, denial of service conditions where legitimate network traffic is dropped due to lack of routing resources, or potentially arbitrary code execution if the underlying data structures are corrupted beyond simple overflow states. In high-churn environments typical of mobile ad-hoc networks, this flaw could be triggered rapidly by normal operational patterns that involve frequent proxy path updates, making it a persistent risk rather than just an edge-case exploit scenario.
This vulnerability aligns with CWE-401, which describes the missing release of memory after successful allocation, and more specifically CWE-789, concerning the use of memory that has been freed or not properly initialized in terms of state tracking. From a threat modeling perspective using the MITRE ATT&CK framework, this flaw facilitates resource exhaustion attacks (T1496) by allowing an actor to consume system resources beyond configured limits without detection. It also touches upon improper input validation and boundary enforcement mechanisms that are critical for maintaining integrity in network stack implementations. The lack of proper accounting creates a state inconsistency that can be leveraged to destabilize the host operating system's networking subsystem.
To mitigate this vulnerability, kernel developers have implemented a fix that ensures proxy paths reserve their quota from the shared budget at the time of allocation via mpp_path_add(). This change guarantees that every successful addition consumes one unit of the 1024-entry limit available to both mesh and proxy paths. Furthermore, if an addition fails due to space constraints or other errors, the reserved slot is correctly released back to the pool. This synchronization ensures that the interface counter accurately reflects the total number of active path entries at all times. System administrators should ensure their Linux kernels are updated with patches addressing this mac80211 accounting logic error. For environments running vulnerable versions, monitoring for unusual spikes in mesh routing table sizes and implementing strict rate-limiting on neighbor discovery protocols can provide partial defense-in-depth against exploitation attempts until the underlying kernel issue is resolved through official updates.