CVE-2026-23279

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()

In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferenced

at lines 1638 and 1642 without a prior NULL check:

ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl;

...

pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);

The mesh_matches_local() check above only validates the Mesh ID,

Mesh Configuration, and Supported Rates IEs. It does not verify the

presence of the Mesh Channel Switch Parameters IE (element ID 118).

When a received CSA action frame omits that IE, ieee802_11_parse_elems()

leaves elems->mesh_chansw_params_ie as NULL, and the unconditional

dereference causes a kernel NULL pointer dereference.

A remote mesh peer with an established peer link (PLINK_ESTAB) can

trigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action frame

that includes a matching Mesh ID and Mesh Configuration IE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References