CVE-2026-98327 - Vulnerability Details

- wifi: mac80211: mesh: reset the CSA state when leaving

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: mesh: reset the CSA state when leaving

ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed
in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes.
Leaving the mesh while a switch is still pending therefore leaks it.

Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak
in this case, so things can get mixed up in addition to the memory
leak.

Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.

Published: 2026-10-06

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux mac80211 mesh stack fails to free the channel‑switch‑announcement (CSA) data when a station leaves while a channel switch is still pending, causing a memory leak. Additionally, the CSA role and channel‑switch time‑to‑live values also leak, potentially mixing state across subsequent sessions and exposing kernel internal data to any process that can observe the memory content.

Affected Systems

All Linux kernel implementations that include the mac80211 mesh subsystem. The issue is in the generic kernel source, so any distribution running a kernel built with this stack is potentially affected until the fix is applied.

Risk and Exploitability

A local user or process that can control the mesh interface is required to trigger the defect. The likely attack vector is a local user issuing commands to leave the mesh while a channel switch is still pending. The resulting memory leak may reveal kernel data, and the corrupted state can lead to operational instability. No remote exploitation path is indicated by the description, and the vulnerability is not listed in CISA KEV. The CVSS score of 5.5 indicates a moderate impact, and an EPSS score of < 1% indicates a very low probability of exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b8456a14e9d2770846fcf74de18ff95b676149a3`	affected	< aba8dfb45864441199748c33ce3c1c8ca121c8bd
`b8456a14e9d2770846fcf74de18ff95b676149a3`	affected	< bd3b21145ae2e781daac1bbd19216a63ab4e0cbd
`b8456a14e9d2770846fcf74de18ff95b676149a3`	affected	< ba5bf83a81e8832cb84bb3a2da67512f81f57a02
`b8456a14e9d2770846fcf74de18ff95b676149a3`	affected	< 860134b3af77970e006feab7e5decb8c84771c7f

Linux

affected

Version	Status	Constraints
`3.13`	affected	—
`0`	unaffected	< 3.13
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b8456a14e9d2770846fcf74de18ff95b676149a3,aba8dfb45864441199748c33ce3c1c8ca121c8bd)`	affected	code_commit	—
`[b8456a14e9d2770846fcf74de18ff95b676149a3,bd3b21145ae2e781daac1bbd19216a63ab4e0cbd)`	affected	code_commit	—
`[b8456a14e9d2770846fcf74de18ff95b676149a3,ba5bf83a81e8832cb84bb3a2da67512f81f57a02)`	affected	code_commit	—
`[b8456a14e9d2770846fcf74de18ff95b676149a3,860134b3af77970e006feab7e5decb8c84771c7f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.13`	affected	generic	—
`[0,3.13)`	unaffected	semver	—
`[6.12.112,6.13.0]`	unaffected	semver	—
`[6.18.54,6.19.0]`	unaffected	semver	—
`[7.2.8,7.3.0]`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that contains the patch for the mesh CSA teardown issue
If immediate kernel upgrade is not possible, avoid stopping mesh interfaces while a channel switch is in progress; monitor the switch status before leaving the network
If mesh networking is not required, disable or unload the mac80211 mesh module to eliminate the risk

Generated by OpenCVE AI on October 11, 2026 at 06:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98327.mbox
https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f
https://git.kernel.org/stable/c/aba8dfb45864441199748c33ce3c1c8ca121c8bd
https://git.kernel.org/stable/c/ba5bf83a81e8832cb84bb3a2da67512f81f57a02
https://git.kernel.org/stable/c/bd3b21145ae2e781daac1bbd19216a63ab4e0cbd
https://nvd.nist.gov/vuln/detail/CVE-2026-98327
https://www.cve.org/CVERecord?id=CVE-2026-98327

History

Sun, 11 Oct 2026 05:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-789

Sun, 11 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98327.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98327 https://www.cve.org/CVERecord?id=CVE-2026-98327
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 06 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-789

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes. Leaving the mesh while a switch is still pending therefore leaks it. Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak in this case, so things can get mixed up in addition to the memory leak. Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.
Title		wifi: mac80211: mesh: reset the CSA state when leaving
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f https://git.kernel.org/stable/c/aba8dfb45864441199748c33ce3c1c8ca121c8bd https://git.kernel.org/stable/c/ba5bf83a81e8832cb84bb3a2da67512f81f57a02 https://git.kernel.org/stable/c/bd3b21145ae2e781daac1bbd19216a63ab4e0cbd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:46:20.317Z

Updated: 2026-10-19T09:17:37.676Z

Reserved: 2026-09-25T10:25:14.341Z

Link: CVE-2026-98327

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:24.980

Modified: 2026-10-19T10:18:34.890

Link: CVE-2026-98327

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98327 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-11T06:30:13Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object