CVE-2026-23279
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the mesh_rx_csa_frame() function in mac80211 dereferences elems->mesh_chansw_params_ie without a NULL check. When a received CSA action frame omits the Mesh Channel Switch Parameters IE (element ID 118), the pointer remains NULL, causing a kernel NULL pointer dereference and crash. The bug has been present since kernel v3.13 (2014).
Risk Assessment
A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger a kernel crash (denial of service) by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame. No authentication beyond default open mesh peering is required.
Recommendation
Update the Linux kernel to a version containing the fix that adds a NULL check for mesh_chansw_params_ie. If immediate update is not possible, consider restricting or disabling mesh functionality in mac80211 until the patch is applied.
Other vulnerabilities in Linux kernel (mac80211)
See all- CVE-2026-98829Low risk· EPSS 5%
In the Linux kernel, ieee80211_rx_h_defragment() accumulates fragment payload lengths into the u16 field extra_len. When the sum of fragment lengths exceeds 65535 bytes, the value wraps around modulo 65536, causing an undersized buffer allocation and triggering skb_over_panic() in softirq context, which crashes the kernel.
- CVE-2026-23396Medium
In the Linux kernel, mesh_matches_local() in mac80211 unconditionally dereferences ie->mesh_config. When called from mesh_rx_csa_frame(), the parsed action-frame elements may lack a Mesh Configuration IE, leaving the pointer NULL and causing a kernel NULL pointer dereference. An adjacent attacker can exploit this by sending a crafted CSA action frame with a valid Mesh ID IE but without the Mesh Configuration IE.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value); The mesh_matches_local() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee802_11_parse_elems() leaves elems->mesh_chansw_params_ie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference. A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required. Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000 Fix by adding a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded throughout the mesh code. The bug has been present since v3.13 (released 2014-01-19).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS