CVE-2026-98705

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: account proxy paths against the mesh path limit

Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH MAX MPATHS.

mesh path free rcu() decrements the interface mpaths counter for entries from both the mesh and proxy path tables, but mpp path add() never reserves a slot in that counter. Removing or expiring a proxy path therefore returns a slot that was never charged.

mesh path add() uses the same counter to enforce MESH MAX MPATHS, so once it falls below the number of installed paths the limit no longer holds.

Reserve the shared quota before allocating a proxy path and release it on every unsuccessful addition. Mesh and proxy paths now share one 1024-entry budget, so mpp path add() can return -ENOSPC at that limit.