CVE-2026-23279

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23279
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value); The mesh_matches_local() check above only validates the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not verify the presence of the Mesh Channel Switch Parameters IE (element ID 118). When a received CSA action frame omits that IE, ieee802_11_parse_elems() leaves elems->mesh_chansw_params_ie as NULL, and the unconditional dereference causes a kernel NULL pointer dereference. A remote mesh peer with an established peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes a matching Mesh ID and Mesh Configuration IE but omits the Mesh Channel Switch Parameters IE. No authentication beyond the default open mesh peering is required. Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000 Fix by adding a NULL check for mesh_chansw_params_ie after mesh_matches_local() returns, consistent with how other optional IEs are guarded throughout the mesh code. The bug has been present since v3.13 (released 2014-01-19).

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11 Patch
https://git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c Patch
https://git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab Patch
https://git.kernel.org/stable/c/753ad20dcbe36b67088c7770d8fc357d7cc43e08 Patch
https://git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421 Patch
https://git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60 Patch
https://git.kernel.org/stable/c/f061336f072ab03fd29270ae61fede46bf8fd69d Patch
https://git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
History

22 May 2026, 00:37

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11 - () https://git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11 - Patch
References () https://git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c - () https://git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c - Patch
References () https://git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab - () https://git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab - Patch
References () https://git.kernel.org/stable/c/753ad20dcbe36b67088c7770d8fc357d7cc43e08 - () https://git.kernel.org/stable/c/753ad20dcbe36b67088c7770d8fc357d7cc43e08 - Patch
References () https://git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421 - () https://git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421 - Patch
References () https://git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60 - () https://git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60 - Patch
References () https://git.kernel.org/stable/c/f061336f072ab03fd29270ae61fede46bf8fd69d - () https://git.kernel.org/stable/c/f061336f072ab03fd29270ae61fede46bf8fd69d - Patch
References () https://git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a - () https://git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476

18 Apr 2026, 09:16

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: wifi: mac80211: corrige la desreferencia de puntero NULL en mesh_rx_csa_frame() En mesh_rx_csa_frame(), elems->mesh_chansw_params_ie es desreferenciado en las líneas 1638 y 1642 sin una verificación de NULL previa: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value); La verificación mesh_matches_local() anterior solo valida el ID de Malla, la Configuración de Malla y los IEs de Tasas Soportadas. No verifica la presencia del IE de Parámetros de Cambio de Canal de Malla (ID de elemento 118). Cuando un frame de acción CSA recibido omite ese IE, ieee802_11_parse_elems() deja elems->mesh_chansw_params_ie como NULL, y la desreferencia incondicional causa una desreferencia de puntero NULL del kernel. Un par de malla remoto con un enlace de par establecido (PLINK_ESTAB) puede activar esto enviando un frame de acción SPECTRUM_MGMT/CHL_SWITCH manipulado que incluye un ID de Malla y un IE de Configuración de Malla coincidentes, pero omite el IE de Parámetros de Cambio de Canal de Malla. No se requiere autenticación más allá del emparejamiento de malla abierta predeterminado. Fallo confirmado en el kernel 6.17.0-5-generic a través de mac80211_hwsim: BUG: desreferencia de puntero NULL del kernel, dirección: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000 Solución añadiendo una verificación de NULL para mesh_chansw_params_ie después de que mesh_matches_local() retorne, consistente con cómo otros IEs opcionales son protegidos a lo largo del código de malla. El error ha estado presente desde la v3.13 (lanzada el 19-01-2014).
References
  • () https://git.kernel.org/stable/c/753ad20dcbe36b67088c7770d8fc357d7cc43e08 -
  • () https://git.kernel.org/stable/c/f061336f072ab03fd29270ae61fede46bf8fd69d -

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-05-22 00:37

NVD link : CVE-2026-23279

Mitre link : CVE-2026-23279

CVE.ORG link : CVE-2026-23279

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference