---
id: CVE-2026-98705
title: 'wifi: mac80211: account proxy paths against the mesh path limit'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: account proxy paths against the mesh path limit

  Proxy-path churn can drive the interface path counter negative and let
  later mesh path additions exceed…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c <
    df072db65fdaa34ad15e1d66fc06a53e3e97f778
  - >-
    Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c <
    3b75831ceee76d32bb8e7ddd241904f92f9b5407
  - >-
    Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c <
    5a32409ed34a1868830899a5d2437f0b3bf3532c
  - >-
    Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c <
    a5f35d4b112af1415ff06bd501c8cc26cc08aa8b
  - Linux 3.2
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:46:35.520Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98705'
references:
  - url: 'https://git.kernel.org/stable/c/df072db65fdaa34ad15e1d66fc06a53e3e97f778'
  - url: 'https://git.kernel.org/stable/c/3b75831ceee76d32bb8e7ddd241904f92f9b5407'
  - url: 'https://git.kernel.org/stable/c/5a32409ed34a1868830899a5d2437f0b3bf3532c'
  - url: 'https://git.kernel.org/stable/c/a5f35d4b112af1415ff06bd501c8cc26cc08aa8b'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.514Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: account proxy paths against the mesh path limit

Proxy-path churn can drive the interface path counter negative and let
later mesh path additions exceed MESH_MAX_MPATHS.

mesh_path_free_rcu() decrements the interface mpaths counter for entries
from both the mesh and proxy path tables, but mpp_path_add() never
reserves a slot in that counter. Removing or expiring a proxy path
therefore returns a slot that was never charged.

mesh_path_add() uses the same counter to enforce MESH_MAX_MPATHS, so once
it falls below the number of installed paths the limit no longer holds.

Reserve the shared quota before allocating a proxy path and release it on
every unsuccessful addition. Mesh and proxy paths now share one
1024-entry budget, so mpp_path_add() can return -ENOSPC at that limit.

## Affected

- `Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c < df072db65fdaa34ad15e1d66fc06a53e3e97f778`
- `Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c < 3b75831ceee76d32bb8e7ddd241904f92f9b5407`
- `Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c < 5a32409ed34a1868830899a5d2437f0b3bf3532c`
- `Linux >= ece1a2e7e86078c8379937b546e32cb7f25fcb6c < a5f35d4b112af1415ff06bd501c8cc26cc08aa8b`
- `Linux 3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.