CVE-2026-23396

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix NULL deref in mesh_matches_local()

mesh_matches_local() unconditionally dereferences ie->mesh_config to

compare mesh configuration parameters. When called from

mesh_rx_csa_frame(), the parsed action-frame elements may not contain a

Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a

kernel NULL pointer dereference.

The other two callers are already safe:

- ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before

calling mesh_matches_local()

- mesh_plink_get_event() is only reached through

mesh_process_plink_frame(), which checks !elems->mesh_config, too

mesh_rx_csa_frame() is the only caller that passes raw parsed elements

to mesh_matches_local() without guarding mesh_config. An adjacent

attacker can exploit this by sending a crafted CSA action frame that

includes a valid Mesh ID IE but omits the Mesh Configuration IE,

crashing the kernel.

The captured crash

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References