CVE-2026-23279

Vulnerability: NULL pointer dereference in mesh CSA handling

In the Linux kernel's mac80211 subsystem, the function mesh_rx_csa_frame() processes Channel Switch Announcement (CSA) action frames in mesh networks. The function dereferences elems->mesh_chansw_params_ie at lines 1638 and 1642 without first checking if it is NULL. While mesh_matches_local() validates the Mesh ID, Mesh Configuration, and Supported Rates IEs, it does not ensure the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits this IE, the parsing function ieee802_11_parse_elems() leaves the pointer as NULL, leading to an unconditional NULL pointer dereference and a kernel panic [1][4].

Exploitation: Remote trigger from an authenticated mesh peer

An attacker who has established a mesh peer link (PLINK_ESTAB) with a vulnerable system can exploit this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame. The frame must include a matching Mesh ID and Mesh Configuration IE to pass the mesh_matches_local() check, but must deliberately omit the Mesh Channel Switch Parameters IE. No additional authentication beyond default open mesh peering is required. A crash was confirmed on kernel 6.17.0-5-generic using mac80211_hwsim, with the oops showing RIP in ieee80211_mesh_rx_queued_mgmt [1].

Impact: Denial-of-service via kernel crash

Successful exploitation results in a NULL pointer dereference, causing a kernel Oops and effectively a denial-of-service (DoS) condition on the targeted mesh node. The crash disrupts all mesh activities on that node, potentially affecting network connectivity for other mesh peers. No privilege escalation or data exfiltration has been reported.

Mitigation

The fix adds a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded in the mesh code. Patches have been backported to various stable kernel trees. The vulnerability has existed since kernel v3.13 (released 2014-01-19). Affected systems should apply the latest kernel updates from their distribution [2][3].