Cloudanix VulnDB

CVE-2026-99134

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux wireless networking code can let an attacker crash the system or corrupt memory during device association.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Data race between association path and response worker on shared assoc_dev pointer allows NULL dereference or use-after-free when cleanup clears the pointer between the worker's bit test and the handler's dereference; also permits incoherent status/address reads from a second malicious response.

Why it matters to the business

Kernel crashes or memory corruption on systems using IEEE 802.15.4 wireless interfaces can cause denial of service or potential privilege escalation; one day after disclosure the flaw remains unpatched in the wild with no known downstream dependents yet affected.

How an attack unfolds

An attacker initiates an association via mac802154_perform_association, then supplies a malicious second response while the associating bit is still set; the unsynchronized window lets the response handler dereference a cleared or freed assoc_dev or observe torn status values, resulting in NULL dereference or use-after-free.

How to fix it

Apply the upstream fix that replaces the shared pointer with a spinlock-protected cached extended address, resets the completion under the lock, and ensures the handler clears the associating bit before completing; rebuild and boot the patched kernel on affected 802.15.4 devices.

How to confirm the fix worked

Inspect mac802154 source for the new association_lock spinlock, cached address storage, and READ_ONCE/WRITE_ONCE usage around the associating bit; confirm the response handler rechecks the bit and address under the lock before recording results.

Typical attack path

  1. Trigger mac802154 association request from user space
  2. Force a timeout or error path that clears assoc_dev
  3. Inject second association response during the race window
  4. Observe NULL dereference or incoherent status in the handler

How to detect it

Search kernel logs and crash dumps for mac802154 association functions, NULL pointer dereferences, or use-after-free reports involving assoc_dev or mac802154_process_association_resp; correlate with 802.15.4 traffic near association attempts.

  • mac802154_rx_mac_cmd_worker
  • mac802154_process_association_resp
  • assoc_dev NULL dereference
  • mac802154_perform_association

What your security team should do

  • Prioritize kernel update on any system exposing 802.15.4 interfaces
  • Disable unneeded WPAN interfaces until patched
  • Add kernel oops monitoring for mac802154 NULL dereferences

The record

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local->assoc_dev local->assoc_dev is shared between the association path and the association-response worker without common synchronization. mac802154_perform_association() stores the coordinator pointer and waits for a response. Its timeout and error paths clear the pointer and return to mac802154_associate(), which may then free the coordinator object. Meanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit and enter mac802154_process_association_resp(), which dereferences assoc_dev. The worker's bit test and the handler's pointer dereference are not atomic with respect to cleanup. Cleanup can clear assoc_dev between them, causing a NULL dereference, or free the coordinator while the response handler still uses the pointer. The recorded result is exposed to the same window. assoc_status and assoc_addr are written by the handler but read by the association path while the associating bit is still set, so a second response for the same request - a malicious one, for instance - can replace them between those reads and leave the caller with an incoherent status and address pair. The response handler only needs the coordinator extended address. Replace assoc_dev with a cached address, removing the pointer lifetime dependency. Protect the cached address and the associating bit with a dedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee an atomic __le64 access on all 32-bit architectures. wpan_dev->association_lock cannot be reused here: nl802154_associate() holds it across rdev_associate(), hence for the whole of mac802154_perform_association() including the wait for the response. A response handler taking that lock would only get it once the association has already given up. Reset the completion, publish the cached address, and set the associating bit while holding the lock. The response handler takes the lock, rechecks the bit and the cached address, records the response, clears the bit, and only then completes the waiter. Thus cleanup cannot pass the handler between its state check and completion, and the cached 64-bit value cannot tear. The handler clears the bit before completing, not the woken waiter: otherwise complete() is issued under the lock and a second (e.g. malicious) response can reacquire it before the waiter and replace the result. So a wait that returns success implies the bit is already clear, and the success and negative-response paths return directly. The transmit-error and timeout paths still clear it under assoc_lock, which serializes any racing response against the cleanup while the call returns the error it already selected. Both paths snapshot assoc_status and assoc_addr under the same lock. Both users run in process context, so a plain spinlock is sufficient. The lock is not held while waiting for the completion.

Affected packages

Ecosystem Package Introduced Fixed