CVE-2026-23279
NULL Pointer Dereference in Linux mac80211 Mesh Frame Handling
Publication date: 2026-03-25
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 3.13 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a NULL pointer dereference in the Linux kernel's mac80211 mesh networking code triggered by a crafted SPECTRUM_MGMT/CHL_SWITCH action frame missing the Mesh Channel Switch Parameters IE.
Detection on a network or system would involve monitoring for unusual or malformed mesh action frames, specifically those that omit the Mesh Channel Switch Parameters IE (element ID 118) while including matching Mesh ID and Mesh Configuration IEs.
Since no specific detection commands or tools are provided in the context or resources, a general approach would be to capture wireless mesh management frames using tools like tcpdump or Wireshark and analyze the presence or absence of the Mesh Channel Switch Parameters IE in CSA action frames.
- Use tcpdump to capture mesh management frames: sudo tcpdump -i <interface> type mgt subtype action
- Analyze captured frames in Wireshark to check for CSA action frames missing element ID 118 (Mesh Channel Switch Parameters IE).
Additionally, monitoring kernel logs for NULL pointer dereference crashes related to mac80211 (e.g., messages containing ieee80211_mesh_rx_queued_mgmt or BUG: kernel NULL pointer dereference) can help detect exploitation attempts.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's mac80211 wireless subsystem, specifically in the function mesh_rx_csa_frame(). The issue arises because the code dereferences a pointer (elems->mesh_chansw_params_ie) without first checking if it is NULL.
When a crafted Channel Switch Announcement (CSA) action frame is received that omits the Mesh Channel Switch Parameters Information Element (IE), the pointer remains NULL. The code then tries to access this NULL pointer, causing a kernel NULL pointer dereference and leading to a crash.
An attacker who is a remote mesh peer with an established peer link can exploit this by sending a specially crafted frame that includes some valid mesh elements but omits the critical Mesh Channel Switch Parameters IE. No special authentication is required beyond the default open mesh peering.
How can this vulnerability impact me? :
This vulnerability can cause a denial of service (DoS) by crashing the Linux kernel when the vulnerable function dereferences a NULL pointer. This crash can disrupt wireless mesh networking functionality and potentially affect the stability of the entire system running the affected kernel.
Since the crash is triggered remotely by a mesh peer sending a crafted frame, an attacker could exploit this to repeatedly crash or destabilize devices running the vulnerable Linux kernel, leading to service interruptions.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a NULL pointer dereference in the Linux kernel's mac80211 mesh_rx_csa_frame() function when processing certain mesh channel switch action frames.
Immediate mitigation involves updating the Linux kernel to a version that includes the fix, which adds a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns.
Since the bug has been present since kernel version 3.13, ensure your system is running a patched kernel version released after this vulnerability was fixed.