CVE-2026-23396

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 26, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux wireless mesh networking can let a nearby attacker crash the whole system by sending one specially crafted network message.

Exploitation: Adjacent Network
Attacker needs: Low Privilege
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Memory Corruption
Remediation: Patch
Effort: Low
Patch risk: Low

What it actually does

NULL pointer dereference in mesh_matches_local() when mesh_rx_csa_frame() passes parsed elements lacking a Mesh Configuration IE, causing kernel crash via general protection fault during WiFi mesh CSA frame processing.

Why it matters to the business

Denial of service on affected Linux systems using 802.11s mesh networking, leading to unexpected reboots or hangs; low prevalence reduces widespread operational disruption but requires urgent patching on exposed wireless devices.

How an attack unfolds

An adjacent attacker crafts a CSA action frame containing a valid Mesh ID IE but omitting the Mesh Configuration IE, sends it to a vulnerable Linux mesh node, and triggers the unguarded call to mesh_matches_local() resulting in NULL dereference and kernel panic.

How to fix it

Apply the upstream patch adding an early NULL check for ie->mesh_config in mesh_matches_local() and rebuild the kernel; monitor linux-stable or distribution updates for backports to affected branches.

How to confirm the fix worked

Confirm the NULL check exists at the start of mesh_matches_local() in net/mac80211/mesh.c; test by replaying a CSA frame without Mesh Configuration IE and verify no kernel oops occurs.

Typical attack path

Position within wireless range of target mesh node
Craft 802.11 action frame with Mesh ID IE but no Mesh Configuration IE
Transmit frame to trigger mesh_rx_csa_frame()
mesh_matches_local() dereferences NULL ie->mesh_config causing oops

How to detect it

Search kernel logs for oops messages referencing mesh_matches_local, ieee80211_mesh_rx_queued_mgmt, and null-ptr-deref during cfg80211_wiphy_work; inspect wireless packet captures for CSA action frames lacking Mesh Configuration IE.

What your security team should do

Prioritize kernel updates on any systems exposing WiFi mesh interfaces
Disable 802.11s mesh functionality where not required until patched
Monitor kernel logs for null-ptr-deref in mesh.c during cfg80211_wiphy_work

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not contain a Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a kernel NULL pointer dereference. The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before calling mesh_matches_local() - mesh_plink_get_event() is only reached through mesh_process_plink_frame(), which checks !elems->mesh_config, too mesh_rx_csa_frame() is the only caller that passes raw parsed elements to mesh_matches_local() without guarding mesh_config. An adjacent attacker can exploit this by sending a crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE, crashing the kernel. The captured crash log: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events_unbound cfg80211_wiphy_work [...] Call Trace: <TASK> ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65) ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686) [...] ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211_wiphy_work (net/wireless/core.c:426) process_one_work (net/kernel/workqueue.c:3280) ? assign_work (net/kernel/workqueue.c:1219) worker_thread (net/kernel/workqueue.c:3352) ? __pfx_worker_thread (net/kernel/workqueue.c:3385) kthread (net/kernel/kthread.c:436) [...] ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255) </TASK> This patch adds a NULL check for ie->mesh_config at the top of mesh_matches_local() to return false early when the Mesh Configuration IE is absent.

Affected packages

Ecosystem	Package	Introduced	Fixed