Linux kernel (mac80211) vulnerabilities

In the Linux kernel, ieee80211_rx_h_defragment() accumulates fragment payload lengths into the u16 field extra_len. When the sum of fragment lengths exceeds 65535 bytes, the value wraps around modulo 65536, causing an undersized buffer allocation and triggering skb_over_panic() in softirq context, which crashes the kernel.

In the Linux kernel, mesh_matches_local() in mac80211 unconditionally dereferences ie->mesh_config. When called from mesh_rx_csa_frame(), the parsed action-frame elements may lack a Mesh Configuration IE, leaving the pointer NULL and causing a kernel NULL pointer dereference. An adjacent attacker can exploit this by sending a crafted CSA action frame with a valid Mesh ID IE but without the Mesh Configuration IE.

In the Linux kernel, the mesh_rx_csa_frame() function in mac80211 dereferences elems->mesh_chansw_params_ie without a NULL check. When a received CSA action frame omits the Mesh Channel Switch Parameters IE (element ID 118), the pointer remains NULL, causing a kernel NULL pointer dereference and crash. The bug has been present since kernel v3.13 (2014).