CVE-2026-90344

What it actually does

The CSA parsing logic in mac80211 incorrectly treats channel number zero as equivalent to absent channel information, allowing an AP-advertised switch to the invalid channel to be ignored rather than triggering a disconnect; on Intel hardware this can additionally trigger a firmware crash.

Why it matters to the business

Wireless clients on affected Linux kernels may remain associated with an AP after an invalid channel switch announcement, resulting in connectivity loss or device instability that disrupts user productivity and requires manual intervention or reboots.

How an attack unfolds

An attacker operating a malicious or compromised access point transmits a Channel Switch Announcement element advertising a switch to channel zero; the flawed parser fails to recognize the invalid target and skips the required disconnect, leaving the client connected and exposing Intel devices to firmware crashes.

How to fix it

Apply the upstream kernel patch that changes the channel and opclass variables to signed integers and uses a negative sentinel value to represent absence; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting the mac80211 CSA parsing code for the use of signed int types and a negative sentinel value; test by associating a client with an AP that sends a CSA to channel zero and verifying that a disconnect occurs without firmware crash.

Typical attack path

1. Attacker configures or compromises a Wi-Fi access point to transmit a CSA element with channel set to zero
2. Client device receives the CSA frame and passes it to mac80211 parsing code
3. Parser equates channel zero with absent data and silently ignores the announcement
4. Client remains associated instead of disconnecting
5. On Intel hardware, subsequent state leads to firmware crash

How to detect it

Review kernel logs for mac80211 CSA handling messages and Intel firmware crash signatures around the time of unexpected disconnections or device resets; correlate with wireless packet captures showing CSA elements containing channel zero.

What your security team should do

• Prioritize kernel updates on all Linux Wi-Fi clients, especially those using Intel wireless hardware
• Monitor vendor advisories for backported fixes in distribution kernels
• Consider temporary network policies that block or alert on unexpected CSA frames until patches are applied