In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh_fast_tx_cache() stores… (CVE-2026-98699)

The vulnerability in the Linux kernel's mac80211 wifi mesh fast transmit path arises because mesh_fast_tx_cache() stores raw pointers to mesh_path structures. When a mesh path is deleted, the cache is flushed and the path memory is freed using kfree_rcu(). However, a concurrent lookup holding the path pointer can insert a new cache entry after the flush, causing the cache to reference freed memory, leading to a use-after-free condition. The fix sets a MESH_PATH_DELETED flag before flushing the cache and skips inserting cache entries if the path or MPP path is marked deleted. This check is performed under the cache walk lock to maintain order with the flush operation. The deletion flag updates use WRITE_ONCE() to ensure atomicity since the cache check reads flags without taking the state_lock.

This vulnerability could lead to use-after-free conditions in the kernel's wifi mesh networking code, potentially causing kernel crashes or memory corruption. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel mesh networking code.

A fix has been implemented in the Linux kernel to address this vulnerability by properly synchronizing cache updates and marking deleted paths to prevent use-after-free. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the current remediation guidance.