CVE-2026-23279 (GCVE-0-2026-23279)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:26 – Updated: 2026-04-18 08:57
VLAI?
Title
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value); The mesh_matches_local() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee802_11_parse_elems() leaves elems->mesh_chansw_params_ie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference. A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required. Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000 Fix by adding a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded throughout the mesh code. The bug has been present since v3.13 (released 2014-01-19).
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < 753ad20dcbe36b67088c7770d8fc357d7cc43e08 (git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < f061336f072ab03fd29270ae61fede46bf8fd69d (git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < 2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab (git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < 22a9adea7e26d236406edc0ea00b54351dd56b9c (git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < f5d8af683410a8c82e48b51291915bd612523d9a (git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < cc6d5a3c0a854aeae00915fc5386570c86029c60 (git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < be8b82c567fda86f2cbb43b7208825125bb31421 (git)
Affected: 8f2535b92d685c68db4bc699dd78462a646f6ef9 , < 017c1792525064a723971f0216e6ef86a8c7af11 (git)
Create a notification for this product.
    Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mesh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "753ad20dcbe36b67088c7770d8fc357d7cc43e08",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            },
            {
              "lessThan": "f061336f072ab03fd29270ae61fede46bf8fd69d",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            },
            {
              "lessThan": "2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            },
            {
              "lessThan": "22a9adea7e26d236406edc0ea00b54351dd56b9c",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            },
            {
              "lessThan": "f5d8af683410a8c82e48b51291915bd612523d9a",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            },
            {
              "lessThan": "cc6d5a3c0a854aeae00915fc5386570c86029c60",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            },
            {
              "lessThan": "be8b82c567fda86f2cbb43b7208825125bb31421",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            },
            {
              "lessThan": "017c1792525064a723971f0216e6ef86a8c7af11",
              "status": "affected",
              "version": "8f2535b92d685c68db4bc699dd78462a646f6ef9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mesh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()\n\nIn mesh_rx_csa_frame(), elems-\u003emesh_chansw_params_ie is dereferenced\nat lines 1638 and 1642 without a prior NULL check:\n\n    ifmsh-\u003echsw_ttl = elems-\u003emesh_chansw_params_ie-\u003emesh_ttl;\n    ...\n    pre_value = le16_to_cpu(elems-\u003emesh_chansw_params_ie-\u003emesh_pre_value);\n\nThe mesh_matches_local() check above only validates the Mesh ID,\nMesh Configuration, and Supported Rates IEs.  It does not verify the\npresence of the Mesh Channel Switch Parameters IE (element ID 118).\nWhen a received CSA action frame omits that IE, ieee802_11_parse_elems()\nleaves elems-\u003emesh_chansw_params_ie as NULL, and the unconditional\ndereference causes a kernel NULL pointer dereference.\n\nA remote mesh peer with an established peer link (PLINK_ESTAB) can\ntrigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame\nthat includes a matching Mesh ID and Mesh Configuration IE but omits the\nMesh Channel Switch Parameters IE.  No authentication beyond the default\nopen mesh peering is required.\n\nCrash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]\n  CR2: 0000000000000000\n\nFix by adding a NULL check for mesh_chansw_params_ie after\nmesh_matches_local() returns, consistent with how other optional IEs\nare guarded throughout the mesh code.\n\nThe bug has been present since v3.13 (released 2014-01-19)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-18T08:57:35.221Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/753ad20dcbe36b67088c7770d8fc357d7cc43e08"
        },
        {
          "url": "https://git.kernel.org/stable/c/f061336f072ab03fd29270ae61fede46bf8fd69d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab"
        },
        {
          "url": "https://git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60"
        },
        {
          "url": "https://git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421"
        },
        {
          "url": "https://git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11"
        }
      ],
      "title": "wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23279",
    "datePublished": "2026-03-25T10:26:39.994Z",
    "dateReserved": "2026-01-13T15:37:45.992Z",
    "dateUpdated": "2026-04-18T08:57:35.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23279",
      "date": "2026-04-23",
      "epss": "0.00117",
      "percentile": "0.30397"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23279\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-25T11:16:22.333\",\"lastModified\":\"2026-04-18T09:16:16.163\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()\\n\\nIn mesh_rx_csa_frame(), elems-\u003emesh_chansw_params_ie is dereferenced\\nat lines 1638 and 1642 without a prior NULL check:\\n\\n    ifmsh-\u003echsw_ttl = elems-\u003emesh_chansw_params_ie-\u003emesh_ttl;\\n    ...\\n    pre_value = le16_to_cpu(elems-\u003emesh_chansw_params_ie-\u003emesh_pre_value);\\n\\nThe mesh_matches_local() check above only validates the Mesh ID,\\nMesh Configuration, and Supported Rates IEs.  It does not verify the\\npresence of the Mesh Channel Switch Parameters IE (element ID 118).\\nWhen a received CSA action frame omits that IE, ieee802_11_parse_elems()\\nleaves elems-\u003emesh_chansw_params_ie as NULL, and the unconditional\\ndereference causes a kernel NULL pointer dereference.\\n\\nA remote mesh peer with an established peer link (PLINK_ESTAB) can\\ntrigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame\\nthat includes a matching Mesh ID and Mesh Configuration IE but omits the\\nMesh Channel Switch Parameters IE.  No authentication beyond the default\\nopen mesh peering is required.\\n\\nCrash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\\n  Oops: Oops: 0000 [#1] SMP NOPTI\\n  RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]\\n  CR2: 0000000000000000\\n\\nFix by adding a NULL check for mesh_chansw_params_ie after\\nmesh_matches_local() returns, consistent with how other optional IEs\\nare guarded throughout the mesh code.\\n\\nThe bug has been present since v3.13 (released 2014-01-19).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nwifi: mac80211: corrige la desreferencia de puntero NULL en mesh_rx_csa_frame()\\n\\nEn mesh_rx_csa_frame(), elems-\u0026gt;mesh_chansw_params_ie es desreferenciado en las l\u00edneas 1638 y 1642 sin una verificaci\u00f3n de NULL previa:\\n\\n    ifmsh-\u0026gt;chsw_ttl = elems-\u0026gt;mesh_chansw_params_ie-\u0026gt;mesh_ttl;\\n    ...\\n    pre_value = le16_to_cpu(elems-\u0026gt;mesh_chansw_params_ie-\u0026gt;mesh_pre_value);\\n\\nLa verificaci\u00f3n mesh_matches_local() anterior solo valida el ID de Malla, la Configuraci\u00f3n de Malla y los IEs de Tasas Soportadas. No verifica la presencia del IE de Par\u00e1metros de Cambio de Canal de Malla (ID de elemento 118). Cuando un frame de acci\u00f3n CSA recibido omite ese IE, ieee802_11_parse_elems() deja elems-\u0026gt;mesh_chansw_params_ie como NULL, y la desreferencia incondicional causa una desreferencia de puntero NULL del kernel.\\n\\nUn par de malla remoto con un enlace de par establecido (PLINK_ESTAB) puede activar esto enviando un frame de acci\u00f3n SPECTRUM_MGMT/CHL_SWITCH manipulado que incluye un ID de Malla y un IE de Configuraci\u00f3n de Malla coincidentes, pero omite el IE de Par\u00e1metros de Cambio de Canal de Malla. No se requiere autenticaci\u00f3n m\u00e1s all\u00e1 del emparejamiento de malla abierta predeterminado.\\n\\nFallo confirmado en el kernel 6.17.0-5-generic a trav\u00e9s de mac80211_hwsim:\\n\\n  BUG: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000000\\n  Oops: Oops: 0000 [#1] SMP NOPTI\\n  RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]\\n  CR2: 0000000000000000\\n\\nSoluci\u00f3n a\u00f1adiendo una verificaci\u00f3n de NULL para mesh_chansw_params_ie despu\u00e9s de que mesh_matches_local() retorne, consistente con c\u00f3mo otros IEs opcionales son protegidos a lo largo del c\u00f3digo de malla.\\n\\nEl error ha estado presente desde la v3.13 (lanzada el 19-01-2014).\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/753ad20dcbe36b67088c7770d8fc357d7cc43e08\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f061336f072ab03fd29270ae61fede46bf8fd69d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.