{"id":"CVE-2026-23279","summary":"wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()\n\nIn mesh_rx_csa_frame(), elems-\u003emesh_chansw_params_ie is dereferenced\nat lines 1638 and 1642 without a prior NULL check:\n\n    ifmsh-\u003echsw_ttl = elems-\u003emesh_chansw_params_ie-\u003emesh_ttl;\n    ...\n    pre_value = le16_to_cpu(elems-\u003emesh_chansw_params_ie-\u003emesh_pre_value);\n\nThe mesh_matches_local() check above only validates the Mesh ID,\nMesh Configuration, and Supported Rates IEs.  It does not verify the\npresence of the Mesh Channel Switch Parameters IE (element ID 118).\nWhen a received CSA action frame omits that IE, ieee802_11_parse_elems()\nleaves elems-\u003emesh_chansw_params_ie as NULL, and the unconditional\ndereference causes a kernel NULL pointer dereference.\n\nA remote mesh peer with an established peer link (PLINK_ESTAB) can\ntrigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame\nthat includes a matching Mesh ID and Mesh Configuration IE but omits the\nMesh Channel Switch Parameters IE.  No authentication beyond the default\nopen mesh peering is required.\n\nCrash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]\n  CR2: 0000000000000000\n\nFix by adding a NULL check for mesh_chansw_params_ie after\nmesh_matches_local() returns, consistent with how other optional IEs\nare guarded throughout the mesh code.\n\nThe bug has been present since v3.13 (released 2014-01-19).","modified":"2026-04-14T03:47:32.747988Z","published":"2026-03-25T10:26:39.994Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23279.json","cna_assigner":"Linux"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/017c1792525064a723971f0216e6ef86a8c7af11"},{"type":"WEB","url":"https://git.kernel.org/stable/c/22a9adea7e26d236406edc0ea00b54351dd56b9c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab"},{"type":"WEB","url":"https://git.kernel.org/stable/c/be8b82c567fda86f2cbb43b7208825125bb31421"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cc6d5a3c0a854aeae00915fc5386570c86029c60"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f5d8af683410a8c82e48b51291915bd612523d9a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23279.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23279"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8f2535b92d685c68db4bc699dd78462a646f6ef9"},{"fixed":"2b5f282b1b7241ef624c3399a1cdff0bb1a3eeab"},{"fixed":"22a9adea7e26d236406edc0ea00b54351dd56b9c"},{"fixed":"f5d8af683410a8c82e48b51291915bd612523d9a"},{"fixed":"cc6d5a3c0a854aeae00915fc5386570c86029c60"},{"fixed":"be8b82c567fda86f2cbb43b7208825125bb31421"},{"fixed":"017c1792525064a723971f0216e6ef86a8c7af11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23279.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"fixed":"6.1.167"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.130"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.77"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.17"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23279.json"}}],"schema_version":"1.7.5"}