In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn… (CVE-2026-98705)

The Linux kernel mac80211 subsystem had a vulnerability where proxy-path churn could decrement the interface path counter below zero, allowing subsequent mesh path additions to exceed the MESH_MAX_MPATHS limit. This occurred because mesh_path_free_rcu() decremented the interface mpaths counter for entries from both mesh and proxy path tables, but mpp_path_add() did not reserve a slot for proxy paths. Consequently, removing or expiring a proxy path returned a slot that was never charged, breaking the enforcement of the mesh path limit. The fix reserves the shared quota before allocating a proxy path and releases it on unsuccessful additions, making mesh and proxy paths share a 1024-entry budget and enabling mpp_path_add() to return -ENOSPC when the limit is reached.

The vulnerability could allow the mesh path limit to be exceeded, potentially leading to resource exhaustion or instability in the mesh networking subsystem of the Linux kernel. This could affect network reliability or performance in environments using mesh networking. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly account for proxy paths against the mesh path limit by sharing a 1024-entry budget and enforcing limits in mpp_path_add(). Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel advisory for the specific fixed versions and update accordingly.