Cloudanix VulnDB

CVE-2026-98335

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless mesh networking bug can make Linux systems crash when they try to change channels while leaving a mesh network.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to abort an active channel switch announcement (CSA) when ieee80211_stop_mesh releases the channel context leaves the CSA finalize workqueue active, resulting in a null pointer dereference inside ieee80211_put_srates_elem during ieee80211_mesh_build_beacon.

Why it matters to the business

Kernel crash or denial of service on Linux systems using 802.11s mesh networking when channel switching is in progress, causing unplanned reboots and loss of wireless connectivity.

How an attack unfolds

An attacker or local process triggers a mesh interface stop (ieee80211_stop_mesh) while a CSA is queued; the pending ieee80211_csa_finalize work then executes after the channel context has been released, dereferencing a null pointer and crashing the kernel.

How to fix it

Apply the upstream fix that calls ieee80211_abort_csa inside ieee80211_stop_mesh before releasing the channel context; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Confirm the presence of the abort logic in ieee80211_stop_mesh, reproduce the original crash scenario in a test environment, and verify that no general protection fault occurs in ieee80211_csa_finalize.

Typical attack path

  1. Establish or join an 802.11s mesh interface
  2. Initiate a channel switch announcement on the mesh
  3. Trigger mesh teardown or interface removal before CSA completes
  4. Trigger execution of the pending CSA finalize workqueue item

How to detect it

Search kernel logs and dmesg for general protection faults or KASAN reports containing ieee80211_csa_finalize, ieee80211_mesh_build_beacon, and ieee80211_put_srates_elem; correlate with mesh interface teardown events.

  • ieee80211_csa_finalize
  • ieee80211_mesh_finish_csa
  • ieee80211_put_srates_elem+0x42
  • KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]

What your security team should do

  • Prioritize kernel updates on systems exposing 802.11s mesh interfaces
  • Monitor kernel logs for oops signatures involving mac80211 mesh and CSA finalize
  • Disable mesh functionality on non-essential wireless devices until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211_stop_mesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272 Call Trace: ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093 ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147 ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline] __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline] ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438 Abort the channel switch properly.

Affected packages

Ecosystem Package Introduced Fixed