VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98326: Linux kernel · wifi: mac80211: mesh: release the channel if start fails

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f0afcec2129c166e61821d6ae097061155f01b12 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f0afcec2129c166e61821d6ae097061155f01b12, b51f5a310bd6888b90bb9546a8081215dcfe6fbe, ae97fff6495a8764bc0ef281cfe5444f701e527f +3

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2b5e19677592c167d012c2d129407f39d2bdeb8d, < f0afcec2129c166e61821d6ae097061155f01b12	Fixed in f0afcec2129c166e61821d6ae097061155f01b12
LinuxLinux	Affected ≥ 2b5e19677592c167d012c2d129407f39d2bdeb8d, < b51f5a310bd6888b90bb9546a8081215dcfe6fbe	Fixed in b51f5a310bd6888b90bb9546a8081215dcfe6fbe
LinuxLinux	Affected ≥ 2b5e19677592c167d012c2d129407f39d2bdeb8d, < ae97fff6495a8764bc0ef281cfe5444f701e527f	Fixed in ae97fff6495a8764bc0ef281cfe5444f701e527f
LinuxLinux	Affected ≥ 2b5e19677592c167d012c2d129407f39d2bdeb8d, < 632f7acfe6dac1278a9314eaaab14fada400ddaf	Fixed in 632f7acfe6dac1278a9314eaaab14fada400ddaf
LinuxLinux	Affected ≥ 2b5e19677592c167d012c2d129407f39d2bdeb8d, < 41bee71112db53651ba9a9030de1b843255a4a7f	Fixed in 41bee71112db53651ba9a9030de1b843255a4a7f
LinuxLinux	Affected ≥ 2b5e19677592c167d012c2d129407f39d2bdeb8d, < 4a4e3fa77ea36d3419d806fb5883ef425a605a5d	Fixed in 4a4e3fa77ea36d3419d806fb5883ef425a605a5d

AI-suggested

A fix is available in the Linux kernel commits identified by hashes f0afcec2129c166e61821d6ae097061155f01b12, b51f5a310bd6888b90bb9546a8081215dcfe6fbe, ae97fff6495a8764bc0ef281cfe5444f701e527f, 632f7acfe6dac1278a9314eaaab14fada400ddaf, 41bee71112db53651ba9a9030de1b843255a4a7f, and 4a4e3fa77ea36d3419d806fb5883ef425a605a5d. Users should update to a Linux kernel version including these fixes to remediate the issue.

Description

A vulnerability in the Linux kernel's mac80211 wireless subsystem related to mesh networking was fixed. The issue involved failure to release a channel context if starting the mesh interface failed, leading to improper channel unassignment during interface removal and resulting warnings or errors. This flaw was addressed by ensuring the channel is correctly released on start failures.

Impact

Failure to release the channel context on mesh start failure can cause kernel warnings and potentially unstable behavior in the wireless subsystem during interface removal. There is no indication of remote code execution or privilege escalation. The impact is primarily on system stability and correctness of wireless interface management.

Summary

The vulnerability in Linux kernel mac80211 mesh networking occurs because ieee80211_join_mesh() acquires a channel context and calls ieee80211_start_mesh(), which can fail. If the start fails, the channel context is not released, causing interface removal to attempt unassigning a channel context that has already been removed from the driver. This leads to runtime warnings and potential instability. The fix ensures that the channel context is properly released when ieee80211_start_mesh() fails.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:40 UTC

Technical details

References

Community reviews

Related threats