CVE-2026-23396
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, mesh_matches_local() in mac80211 unconditionally dereferences ie->mesh_config. When called from mesh_rx_csa_frame(), the parsed action-frame elements may lack a Mesh Configuration IE, leaving the pointer NULL and causing a kernel NULL pointer dereference. An adjacent attacker can exploit this by sending a crafted CSA action frame with a valid Mesh ID IE but without the Mesh Configuration IE.
Risk Assessment
An attacker within range of the mesh network can remotely trigger a kernel crash (denial of service) on the affected device. This may cause network service unavailability and require a device restart.
Recommendation
Update the Linux kernel to a version containing the fix that adds a NULL check for ie->mesh_config in mesh_matches_local(). Until patched, consider limiting mesh network exposure or monitoring for unusual management frames.
Other vulnerabilities in Linux kernel (mac80211)
See all- CVE-2026-98829Low risk· EPSS 5%
In the Linux kernel, ieee80211_rx_h_defragment() accumulates fragment payload lengths into the u16 field extra_len. When the sum of fragment lengths exceeds 65535 bytes, the value wraps around modulo 65536, causing an undersized buffer allocation and triggering skb_over_panic() in softirq context, which crashes the kernel.
- CVE-2026-23279Medium
In the Linux kernel, the mesh_rx_csa_frame() function in mac80211 dereferences elems->mesh_chansw_params_ie without a NULL check. When a received CSA action frame omits the Mesh Channel Switch Parameters IE (element ID 118), the pointer remains NULL, causing a kernel NULL pointer dereference and crash. The bug has been present since kernel v3.13 (2014).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not contain a Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a kernel NULL pointer dereference. The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before calling mesh_matches_local() - mesh_plink_get_event() is only reached through mesh_process_plink_frame(), which checks !elems->mesh_config, too mesh_rx_csa_frame() is the only caller that passes raw parsed elements to mesh_matches_local() without guarding mesh_config. An adjacent attacker can exploit this by sending a crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE, crashing the kernel. The captured crash log: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events_unbound cfg80211_wiphy_work [...] Call Trace: <TASK> ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65) ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686) [...] ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211_wiphy_work (net/wireless/core.c:426) process_one_work (net/kernel/workqueue.c:3280) ? assign_work (net/kernel/workqueue.c:1219) worker_thread (net/kernel/workqueue.c:3352) ? __pfx_worker_thread (net/kernel/workqueue.c:3385) kthread (net/kernel/kthread.c:436) [...] ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255) </TASK> This patch adds a NULL check for ie->mesh_config at the top of mesh_matches_local() to return false early when the Mesh Configuration IE is absent.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS