All vulnerabilities
CVE-2026-98699

Linux: wifi: mac80211: fix mesh fast xmit path deletion UAF

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0117f1aa189495e6f1ff608681678817995aee39Also 128e800a41270ab197b1cc8043637a2924865608, 93da3ec938bfdcfb3899428f04c6d0c56fe32952CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0117f1aa189495e6f1ff608681678817995aee39LinuxCVE List
  • 128e800a41270ab197b1cc8043637a2924865608LinuxCVE List
  • 93da3ec938bfdcfb3899428f04c6d0c56fe32952LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix mesh fast xmit path deletion UAF

mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion flushes the cache and then frees the path with kfree_rcu(), but a lookup that already holds the path can insert a new cache entry after the flush. The cache then points at freed memory.

Set MESH_PATH_DELETED before flushing, and skip inserting a cache entry if the path or MPP path is already deleted. Check this under the cache walk lock so it is ordered with the flush. Use WRITE_ONCE() for the deletion flag updates because the cache check reads flags without taking state_lock.

Text from CVE List

Affected versions 12

  • Linuxaffected: d5edb9ae8d568745f893c5c5fa3837d85311b131 before ebb7cba623d38733d33d79a8c7442f5ea04c0fb0CVE List
  • Linuxaffected: d5edb9ae8d568745f893c5c5fa3837d85311b131 before 0117f1aa189495e6f1ff608681678817995aee39CVE List
  • Linuxaffected: d5edb9ae8d568745f893c5c5fa3837d85311b131 before 128e800a41270ab197b1cc8043637a2924865608CVE List
  • Linuxaffected: d5edb9ae8d568745f893c5c5fa3837d85311b131 before 93da3ec938bfdcfb3899428f04c6d0c56fe32952CVE List
  • Linuxaffected: d5edb9ae8d568745f893c5c5fa3837d85311b131 before ee3aadc43ea69d98f666431e787137ac0badbb85CVE List
  • Linuxaffected: 6.4CVE List
  • Linuxunaffected: all versions before 6.4CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5