wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-23279
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-03-25 11:16:22 UTC
Updated2026-04-18 09:16:16 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value); The mesh_matches_local() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee802_11_parse_elems() leaves elems->mesh_chansw_params_ie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference. A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required. Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000 Fix by adding a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded throughout the mesh code. The bug has been present since v3.13 (released 2014-01-19).

Risk And Classification

EPSS: 0.001170000 probability, percentile 0.303530000 (date 2026-04-19)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 753ad20dcbe36b67088c7770d8fc357d7cc43e08 git Not specified
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 f061336f072ab03fd29270ae61fede46bf8fd69d git Not specified
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab git Not specified
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 22a9adea7e26d236406edc0ea00b54351dd56b9c git Not specified
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 f5d8af683410a8c82e48b51291915bd612523d9a git Not specified
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 cc6d5a3c0a854aeae00915fc5386570c86029c60 git Not specified
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 be8b82c567fda86f2cbb43b7208825125bb31421 git Not specified
CNA Linux Linux affected 8f2535b92d685c68db4bc699dd78462a646f6ef9 017c1792525064a723971f0216e6ef86a8c7af11 git Not specified
CNA Linux Linux affected 3.13 Not specified
CNA Linux Linux unaffected 3.13 semver Not specified
CNA Linux Linux unaffected 5.10.253 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.203 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.167 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.130 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.77 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.17 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.7 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/753ad20dcbe36b67088c7770d8fc357d7cc43e08 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f061336f072ab03fd29270ae61fede46bf8fd69d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report