CVE-2026-98327
wifi: mac80211: mesh: reset the CSA state when leaving
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ b8456a14e9d2770846fcf74de18ff95b676149a3, < aba8dfb45864441199748c33ce3c1c8ca121c8bdUpgrade to: aba8dfb45864441199748c33ce3c1c8ca121c8bdAffected: ≥ b8456a14e9d2770846fcf74de18ff95b676149a3, < bd3b21145ae2e781daac1bbd19216a63ab4e0cbdUpgrade to: bd3b21145ae2e781daac1bbd19216a63ab4e0cbdAffected: ≥ b8456a14e9d2770846fcf74de18ff95b676149a3, < ba5bf83a81e8832cb84bb3a2da67512f81f57a02Upgrade to: ba5bf83a81e8832cb84bb3a2da67512f81f57a02Affected: ≥ b8456a14e9d2770846fcf74de18ff95b676149a3, < 860134b3af77970e006feab7e5decb8c84771c7fUpgrade to: 860134b3af77970e006feab7e5decb8c84771c7fStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes. Leaving the mesh while a switch is still pending therefore leaks it. Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak in this case, so things can get mixed up in addition to the memory leak. Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f
- git.kernel.org/stable/c/aba8dfb45864441199748c33ce3c1c8ca121c8bd
- git.kernel.org/stable/c/ba5bf83a81e8832cb84bb3a2da67512f81f57a02
And 1 more reference. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI