The kernel function that manages addition of mesh routing paths allocates a reservation slot before performing allocation and table insertion. When allocation fails, a rhashtable insertion error occurs, or a duplicate destination is detected, the function exits without releasing the previously reserved slot, causing the global counter for the maximum number of mesh paths, MESH_MAX_MPATHS, to become permanently decremented. After repeated failures the counter reaches zero and no new mesh paths can be established, effectively starving the network of routes and blocking further mesh communication.

All systems that use the Linux kernel with the mac80211 wireless subsystem supporting mesh networking are affected. Because no specific version range is listed, any kernel release prior to the commit that introduced the fix is vulnerable. The affected product is the Linux kernel as identified in the Common Platform Enumeration.

The vulnerability carries a CVSS score of 4.3 and an EPSS score of < 1%, indicating a moderate likelihood of exploitation but very low overall probability. Based on the description, it is inferred that an attacker can trigger the flaw by sending repeated failed or duplicate mesh path addition requests over the wireless network; this may be possible from a local or remote device that can inject such frames. The flaw does not involve privilege escalation or code execution; its primary impact is loss of connectivity caused by resource exhaustion in the kernel’s mesh routing subsystem. The vulnerability is not listed in the CISA KEV catalog, but applying the patch that releases the reservation on failure is the recommended response.