wifi: mac80211: fix NULL deref in mesh_matches_local()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not contain a Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a kernel NULL pointer dereference. The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before calling mesh_matches_local() - mesh_plink_get_event() is only reached through mesh_process_plink_frame(), which checks !elems->mesh_config, too mesh_rx_csa_frame() is the only caller that passes raw parsed elements to mesh_matches_local() without guarding mesh_config. An adjacent attacker can exploit this by sending a crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE, crashing the kernel. The captured crash log: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events_unbound cfg80211_wiphy_work [...] Call Trace: ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65) ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686) [...] ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211_wiphy_work (net/wireless/core.c:426) process_one_work (net/kernel/workqueue.c:3280) ? assign_work (ne
CVE-2026-23396
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-23396
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "14a4fd13657a3f2489db6566f081adfb27a49c64",
"versionType": "git"
},
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "74de6fa472b03bc8cde0a081484e9960bcbda568",
"versionType": "git"
},
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "c1e3f2416fb27c816ce96d747d3e784e31f4d95c",
"versionType": "git"
},
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "0a4da176ae4b4e075a19c00d3e269cfd5e05a813",
"versionType": "git"
},
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "a90279e7f7ea0b7e923a1c5ebee9a6b78b6d1004",
"versionType": "git"
},
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "44699c6cdfce80a0f296b54ae9314461e3e41b3d",
"versionType": "git"
},
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "7c55a3deaf7eaaafa2546f8de7fed19382a0a116",
"versionType": "git"
},
{
"status": "affected",
"version": "2e3c8736820bf72a8ad10721c7e31d36d4fa7790",
"lessThan": "c73bb9a2d33bf81f6eecaa0f474b6c6dbe9855bd",
"versionType": "git"
}
],
"programFiles": [
"net/mac80211/mesh.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.26",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mac80211/mesh.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-23396
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #27247 · Revision 1
- Added to Heist Feed
- Publisher date