CVE-2026-98326

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: mesh: release the channel if start fails

ieee80211 join mesh() acquires a channel context and then calls ieee80211 start mesh(), which can fail. In that case, the chanctx isn't released then interface removal will attempt to unassign it after it's removed from the driver, hitting:

wlan0: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.c:366 at drv unassign vif chanctx ieee80211 assign link chanctx ieee80211 link release channel ieee80211 link release channel ieee80211 teardown sdata unregister netdevice many notify cfg80211 unregister wdev ieee80211 remove interfaces ieee80211 unregister hw mac80211 hwsim del radio hwsim exit net

Correctly release the channel on start failures.