CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix mesh fast xmit path deletion UAF

mesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion

flushes the cache and then frees the path with kfree_rcu(), but a

lookup that already holds the path can insert a new cache entry

after the flush. The cache then points at freed memory.

Set MESH_PATH_DELETED before flushing, and skip inserting a cache

entry if the path or MPP path is already deleted. Check this under

the cache walk lock so it is ordered with the flush. Use WRITE_ONCE()

for the deletion flag updates because the cache check reads flags

without taking state_lock.