In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix mesh fast xmit path deletion UAF

mesh fast tx cache() stores raw mesh path pointers. Path deletion flushes the cache and then frees the path with kfree rcu(), but a lookup that already holds the path can insert a new cache entry after the flush. The cache then points at freed memory.

Set MESH PATH DELETED before flushing, and skip inserting a cache entry if the path or MPP path is already deleted. Check this under the cache walk lock so it is ordered with the flush. Use WRITE ONCE() for the deletion flag updates because the cache check reads flags without taking state lock.