In the Linux kernel’s mac80211 Wi‑Fi subsystem, a logic flaw allows the interface path counter to be decremented below zero when proxy paths are removed or expire. Because the counter is used to enforce a limit on the number of mesh paths, this underflow permits subsequent additions to bypass the MESH_MAX_MPATHS check. The adversary can craft traffic that triggers frequent proxy path churn, ultimately enabling unlimited mesh path additions. The resulting leakage of the configured path budget can lead to excessive memory consumption and degraded network performance, potentially impacting availability. The flaw is a failure to reserve quota before allocating a proxy path and to release it on unsuccessful attempts, a classic integer underflow resource control issue.

All Linux kernel implementations that include the mac80211 Wi‑Fi stack and use mesh networking. The vulnerability exists in every kernel revision that lacks the counter‑reservation patch, so any distribution build prior to the fix is affected. No specific vendor or version list is supplied, but the patch resides in the upstream kernel tree and is propagated to most major distros shortly after merging.

The EPSS score is <1%, indicating a very low exploitation probability. The CVSS score of 6.5 reflects moderate severity. The flaw lies in the Linux kernel’s mac80211 Wi‑Fi subsystem where proxy‑path churn can cause the interface path counter to underflow. The underflow allows subsequent mesh path additions to bypass the MESH_MAX_MPATHS check, potentially enabling an attacker to create an unlimited number of mesh paths. The likely attack vector involves sending crafted frames to a device running a mesh network; based on the description, it is inferred that such traffic could trigger the path churn. While active exploits are not known and the vulnerability is not listed in CISA KEV, the reduced counter restriction can lead to resource exhaustion and degraded network performance, posing a threat to availability on affected systems.