{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98705", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.365Z", "datePublished": "2026-10-18T15:46:35.520Z", "dateUpdated": "2026-10-21T12:55:53.953Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:55:53.953Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: account proxy paths against the mesh path limit\n\nProxy-path churn can drive the interface path counter negative and let\nlater mesh path additions exceed MESH_MAX_MPATHS.\n\nmesh_path_free_rcu() decrements the interface mpaths counter for entries\nfrom both the mesh and proxy path tables, but mpp_path_add() never\nreserves a slot in that counter. Removing or expiring a proxy path\ntherefore returns a slot that was never charged.\n\nmesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once\nit falls below the number of installed paths the limit no longer holds.\n\nReserve the shared quota before allocating a proxy path and release it on\nevery unsuccessful addition. Mesh and proxy paths now share one\n1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/mesh_pathtbl.c"], "versions": [{"version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "lessThan": "c66ab4b94bb04c162485759196555e08c0965320", "status": "affected", "versionType": "git"}, {"version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "lessThan": "df072db65fdaa34ad15e1d66fc06a53e3e97f778", "status": "affected", "versionType": "git"}, {"version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "lessThan": "3b75831ceee76d32bb8e7ddd241904f92f9b5407", "status": "affected", "versionType": "git"}, {"version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "lessThan": "5a32409ed34a1868830899a5d2437f0b3bf3532c", "status": "affected", "versionType": "git"}, {"version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "lessThan": "a5f35d4b112af1415ff06bd501c8cc26cc08aa8b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/mesh_pathtbl.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c66ab4b94bb04c162485759196555e08c0965320"}, {"url": "https://git.kernel.org/stable/c/df072db65fdaa34ad15e1d66fc06a53e3e97f778"}, {"url": "https://git.kernel.org/stable/c/3b75831ceee76d32bb8e7ddd241904f92f9b5407"}, {"url": "https://git.kernel.org/stable/c/5a32409ed34a1868830899a5d2437f0b3bf3532c"}, {"url": "https://git.kernel.org/stable/c/a5f35d4b112af1415ff06bd501c8cc26cc08aa8b"}], "title": "wifi: mac80211: account proxy paths against the mesh path limit", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/mesh_pathtbl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c66ab4b94bb04c162485759196555e08c0965320", "status": "affected", "version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "versionType": "git"}, {"lessThan": "df072db65fdaa34ad15e1d66fc06a53e3e97f778", "status": "affected", "version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "versionType": "git"}, {"lessThan": "3b75831ceee76d32bb8e7ddd241904f92f9b5407", "status": "affected", "version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "versionType": "git"}, {"lessThan": "5a32409ed34a1868830899a5d2437f0b3bf3532c", "status": "affected", "version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "versionType": "git"}, {"lessThan": "a5f35d4b112af1415ff06bd501c8cc26cc08aa8b", "status": "affected", "version": "ece1a2e7e86078c8379937b546e32cb7f25fcb6c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/mesh_pathtbl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: account proxy paths against the mesh path limit\n\nProxy-path churn can drive the interface path counter negative and let\nlater mesh path additions exceed MESH_MAX_MPATHS.\n\nmesh_path_free_rcu() decrements the interface mpaths counter for entries\nfrom both the mesh and proxy path tables, but mpp_path_add() never\nreserves a slot in that counter. Removing or expiring a proxy path\ntherefore returns a slot that was never charged.\n\nmesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once\nit falls below the number of installed paths the limit no longer holds.\n\nReserve the shared quota before allocating a proxy path and release it on\nevery unsuccessful addition. Mesh and proxy paths now share one\n1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit."}], "id": "CVE-2026-98705", "lastModified": "2026-10-21T13:21:38.797", "metrics": {}, "published": "2026-10-18T16:17:24.017", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b75831ceee76d32bb8e7ddd241904f92f9b5407"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a32409ed34a1868830899a5d2437f0b3bf3532c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a5f35d4b112af1415ff06bd501c8cc26cc08aa8b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c66ab4b94bb04c162485759196555e08c0965320"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df072db65fdaa34ad15e1d66fc06a53e3e97f778"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mac80211: account proxy paths against the mesh path limit", "id": "2555049", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555049"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in the Linux kernel's mac80211 wireless subsystem. When wireless mesh proxy paths are removed or expire, the interface path counter is decremented without having been accounted for during path creation. An attacker can exploit this accounting flaw through rapid proxy path churn, driving the counter down and bypassing the maximum mesh path limit. This failure to enforce path limits can lead to excessive resource consumption and a Denial of Service (DoS)."], "name": "CVE-2026-98705", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98705\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98705\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98705.mbox"], "threat_severity": "Moderate"}