CVE-2026-23279
Analyzed Analyzed - Analysis Complete
NULL Pointer Dereference in Linux mac80211 Mesh Frame Handling

Publication date: 2026-03-25

Last updated on: 2026-05-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value); The mesh_matches_local() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee802_11_parse_elems() leaves elems->mesh_chansw_params_ie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference. A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required. Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000 Fix by adding a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded throughout the mesh code. The bug has been present since v3.13 (released 2014-01-19).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-05-22
Generated
2026-06-16
AI Q&A
2026-03-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23279
EUVD
EUVD-2026-15198
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.19 (inc) to 6.19.7 (exc)
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.17 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.130 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.77 (exc)
linux linux_kernel From 5.11 (inc) to 5.15.203 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.167 (exc)
linux linux_kernel From 3.13 (inc) to 5.10.253 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's mac80211 wireless subsystem, specifically in the function mesh_rx_csa_frame(). The issue arises because the code dereferences a pointer (elems->mesh_chansw_params_ie) without first checking if it is NULL.

When a crafted Channel Switch Announcement (CSA) action frame is received that omits the Mesh Channel Switch Parameters Information Element (IE), the pointer remains NULL. The code then tries to access this NULL pointer, causing a kernel NULL pointer dereference and leading to a crash.

An attacker who is a remote mesh peer with an established peer link can exploit this by sending a specially crafted frame that includes some valid mesh elements but omits the critical Mesh Channel Switch Parameters IE. No special authentication is required beyond the default open mesh peering.

Impact Analysis

This vulnerability can cause a denial of service (DoS) by crashing the Linux kernel when the vulnerable function dereferences a NULL pointer. This crash can disrupt wireless mesh networking functionality and potentially affect the stability of the entire system running the affected kernel.

Since the crash is triggered remotely by a mesh peer sending a crafted frame, an attacker could exploit this to repeatedly crash or destabilize devices running the vulnerable Linux kernel, leading to service interruptions.

Mitigation Strategies

The vulnerability is caused by a NULL pointer dereference in the Linux kernel's mac80211 mesh_rx_csa_frame() function when processing certain mesh channel switch action frames.

Immediate mitigation involves updating the Linux kernel to a version that includes the fix, which adds a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns.

Since the bug has been present since kernel version 3.13, ensure your system is running a patched kernel version released after this vulnerability was fixed.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's mac80211 mesh networking code triggered by a crafted SPECTRUM_MGMT/CHL_SWITCH action frame missing the Mesh Channel Switch Parameters IE.

Detection on a network or system would involve monitoring for unusual or malformed mesh action frames, specifically those that omit the Mesh Channel Switch Parameters IE (element ID 118) while including matching Mesh ID and Mesh Configuration IEs.

Since no specific detection commands or tools are provided in the context or resources, a general approach would be to capture wireless mesh management frames using tools like tcpdump or Wireshark and analyze the presence or absence of the Mesh Channel Switch Parameters IE in CSA action frames.

  • Use tcpdump to capture mesh management frames: sudo tcpdump -i <interface> type mgt subtype action
  • Analyze captured frames in Wireshark to check for CSA action frames missing element ID 118 (Mesh Channel Switch Parameters IE).

Additionally, monitoring kernel logs for NULL pointer dereference crashes related to mac80211 (e.g., messages containing ieee80211_mesh_rx_queued_mgmt or BUG: kernel NULL pointer dereference) can help detect exploitation attempts.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart