SB20261022306 - Missing Release of Resource after Effective Lifetime in Linux kernel mac80211

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022306

SB20261022306 - Missing Release of Resource after Effective Lifetime in Linux kernel mac80211

Published: October 22, 2026

Security Bulletin ID SB20261022306
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98701)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service by exhausting the mesh path quota and preventing new paths to reachable destinations from being created.

The vulnerability exists due to failure to release reserved mesh path slots in the Linux kernel mac80211 mesh_path_add() function when path allocation fails or insertion encounters an error or an existing destination. A local user can trigger repeated failed or duplicate mesh path additions to exhaust MESH_MAX_MPATHS even though the path table contains fewer installed paths, preventing new mesh paths from being created.


Remediation

Install update from vendor's website.

References