Junglewise Threat Intelligence

CVE-2026-23279: Linux Kernel NULL pointer dereference in mac80211 mesh_rx_csa_frame

CVE-2026-23279 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's wireless networking component could allow a nearby attacker to crash the system. By sending a specially crafted wireless management frame to a device using mesh networking, an attacker can trigger a system failure (kernel panic). This affects the availability of the device but does not directly allow for data theft.

Technical details

A NULL pointer dereference exists in the mesh_rx_csa_frame() function within the net/mac80211/mesh.c component of the Linux kernel. The vulnerability is caused by an unconditional dereference of the 'mesh_chansw_params_ie' element without verifying its presence in the received action frame. An attacker with an established mesh peer link (PLINK_ESTAB) can trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that includes valid Mesh ID and Configuration IEs but omits the Mesh Channel Switch Parameters IE (element ID 118). This results in a kernel oops and denial of service. The issue has been patched in multiple stable branches including 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.12.y, 6.18.y, and 6.19.y.

Affected products

  • Linux Linux Kernel 3.13 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7

Timeline

  • 2014-01-19: other: Vulnerability introduced in version 3.13
  • 2026-03-25: advisory: Initial disclosure and CVE assignment
  • 2026-03-25: patched: Patches released across multiple stable kernel branches

References

Related threats