All vulnerabilities
CVE-2026-98327

Linux: wifi: mac80211: mesh: reset the CSA state when leaving

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in860134b3af77970e006feab7e5decb8c84771c7fFixed versionCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 860134b3af77970e006feab7e5decb8c84771c7fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: mesh: reset the CSA state when leaving

ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes. Leaving the mesh while a switch is still pending therefore leaks it.

Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak in this case, so things can get mixed up in addition to the memory leak.

Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.

Text from CVE List

Affected versions 10

  • Linuxaffected: b8456a14e9d2770846fcf74de18ff95b676149a3 before aba8dfb45864441199748c33ce3c1c8ca121c8bdCVE List
  • Linuxaffected: b8456a14e9d2770846fcf74de18ff95b676149a3 before bd3b21145ae2e781daac1bbd19216a63ab4e0cbdCVE List
  • Linuxaffected: b8456a14e9d2770846fcf74de18ff95b676149a3 before ba5bf83a81e8832cb84bb3a2da67512f81f57a02CVE List
  • Linuxaffected: b8456a14e9d2770846fcf74de18ff95b676149a3 before 860134b3af77970e006feab7e5decb8c84771c7fCVE List
  • Linuxaffected: 3.13CVE List
  • Linuxunaffected: all versions before 3.13CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4