---
id: CVE-2026-98701
title: 'wifi: mac80211: release mesh path quota on failed additions'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: release mesh path quota on failed additions

  Repeated failed or duplicate mesh path additions can exhaust
  MESH_MAX_MPATHS while the path table holds few…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb <
    56691ed9ef792f180e008a43294a4dc059fbeca2
  - >-
    Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb <
    a613c891906b558c10a4fa98ca29747b98e857cb
  - >-
    Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb <
    a59eca4557c7462aad1b160011013290a92de97d
  - >-
    Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb <
    7325a44474f20c1393a1c114c6811abce6ddfaf4
  - Linux 3.10
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:46:31.257Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98701'
references:
  - url: 'https://git.kernel.org/stable/c/56691ed9ef792f180e008a43294a4dc059fbeca2'
  - url: 'https://git.kernel.org/stable/c/a613c891906b558c10a4fa98ca29747b98e857cb'
  - url: 'https://git.kernel.org/stable/c/a59eca4557c7462aad1b160011013290a92de97d'
  - url: 'https://git.kernel.org/stable/c/7325a44474f20c1393a1c114c6811abce6ddfaf4'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.515Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: release mesh path quota on failed additions

Repeated failed or duplicate mesh path additions can exhaust
MESH_MAX_MPATHS while the path table holds fewer paths, which stops new
paths to reachable destinations from being created.

mesh_path_add() reserves a slot before allocating and inserting a path.
If allocation fails, the function returns without releasing the slot. If
the rhashtable insertion reports an error or an existing destination, the
function discards its candidate but retains the reservation. No new path
is installed in any of these cases.

Release the reservation whenever the candidate is not installed.

## Affected

- `Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb < 56691ed9ef792f180e008a43294a4dc059fbeca2`
- `Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb < a613c891906b558c10a4fa98ca29747b98e857cb`
- `Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb < a59eca4557c7462aad1b160011013290a92de97d`
- `Linux >= ae76eef027f75fadd8a8eda55ee07707f077aacb < 7325a44474f20c1393a1c114c6811abce6ddfaf4`
- `Linux 3.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.