CVE-2026-98705

The Linux kernel contains a vulnerability in the wifi: mac80211 component where proxy-path churn can drive the interface path counter into negative values. This occurs because mesh_path_free_rcu() decrements the counter for proxy paths, but mpp_path_add() fails to reserve a slot in that counter, ...

CVE-2026-98705

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

EUVD-2026-103959

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

CVE-2026-98705 wifi: mac80211: account proxy paths against the mesh path limit

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

CVE-2026-98701

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

EUVD-2026-103955

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

CVE-2026-98699

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the wifi: mac80211 component related to the mesh fast xmit path . The issue occurs because mesh_fast_tx_cache() stores raw mesh_path pointers; while path deletion flushes the cache and frees the path via kfree_rcu() , a concurrent ...

CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

EUVD-2026-103953

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98701: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

PT-2026-128352

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH MAX MPATHS. mesh path free rcu decrements the interface...

CVE-2026-98699: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98705: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

PT-2026-116924

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mac80211 wifi component where proxy-path churn can cause the interface path counter to become negative. This occurs because mesh path free rcu decrements the...

PT-2026-128560

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH MAX MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

PT-2026-116851

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth management component. In the send cancel function, pending mesh tx objects are removed and freed. However, if a transmission was already...

PT-2026-128573

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh fast tx cache stores raw mesh path pointers. Path deletion flushes the cache and then frees the path with kfree rcu, but a lookup that already holds the path can insert a...

PT-2026-116920

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wifi mac80211 component where repeated failed or duplicate mesh path additions can exhaust MESH MAX MPATHS. This occurs because the mesh path add function reserves...