CVE-2026-23279: Linux Kernel Mesh DoS Vulnerability

CVE-2026-23279 Overview

A NULL pointer dereference vulnerability exists in the Linux kernel's mac80211 WiFi subsystem, specifically in the mesh_rx_csa_frame() function. The vulnerability occurs when processing Channel Switch Announcement (CSA) action frames in mesh networking mode, where the elems->mesh_chansw_params_ie pointer is dereferenced without a prior NULL check. This flaw allows a remote mesh peer with an established peer link to trigger a kernel crash by sending a specially crafted action frame.

Critical Impact
Remote denial of service through kernel crash. A mesh peer can send a crafted SPECTRUM_MGMT/CHL_SWITCH action frame that omits the Mesh Channel Switch Parameters IE, causing a NULL pointer dereference and system crash without requiring authentication beyond default open mesh peering.

Affected Products

Linux kernel versions from v3.13 (released 2014-01-19) through affected versions
Systems using WiFi mesh networking (802.11s) with mac80211 driver stack
Kernel configurations with CONFIG_MAC80211_MESH enabled

Discovery Timeline

2026-03-25 - CVE CVE-2026-23279 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23279

Vulnerability Analysis

The vulnerability resides in the mesh_rx_csa_frame() function within the mac80211 mesh networking code. When a Channel Switch Announcement action frame is received, the function extracts mesh channel switch parameters from the parsed Information Elements (IEs) structure. The code directly accesses elems->mesh_chansw_params_ie->mesh_ttl at line 1638 and elems->mesh_chansw_params_ie->mesh_pre_value at line 1642 without first verifying that the pointer is non-NULL.

The preceding mesh_matches_local() validation only checks for the presence of the Mesh ID, Mesh Configuration, and Supported Rates IEs. It does not validate the presence of the Mesh Channel Switch Parameters IE (element ID 118), which is required for proper CSA frame processing. When ieee802_11_parse_elems() processes a frame that omits this IE, the mesh_chansw_params_ie field remains NULL, leading to the dereference crash.

Root Cause

The root cause is insufficient input validation in the mesh frame parsing logic. The code assumes that if a CSA action frame passes the mesh_matches_local() check, it will contain all required IEs for channel switch processing. This assumption is incorrect, as an attacker can construct a valid-looking CSA frame with matching Mesh ID and Configuration IEs while deliberately omitting the Mesh Channel Switch Parameters IE.

This represents a classic NULL Pointer Dereference vulnerability pattern where optional or attacker-controlled data is accessed without defensive NULL checks, despite the parsing function not guaranteeing the pointer's validity.

Attack Vector

The attack can be executed by a remote mesh peer with an established peer link (PLINK_ESTAB state). The attacker sends a crafted SPECTRUM_MGMT/CHL_SWITCH action frame containing a matching Mesh ID and Mesh Configuration IE but deliberately omits the Mesh Channel Switch Parameters IE. Since mesh networking uses open peering by default, no additional authentication is required beyond establishing the initial peer link.

The crash has been confirmed on kernel 6.17.0-5-generic using the mac80211_hwsim simulator, producing the following kernel oops:

BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: Oops: 0000 [#1] SMP NOPTI
RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211]
CR2: 0000000000000000

Detection Methods for CVE-2026-23279

Indicators of Compromise

Kernel crash logs showing NULL pointer dereference in ieee80211_mesh_rx_queued_mgmt function within the mac80211 module
Unexpected system reboots or crashes on devices operating in WiFi mesh mode
Kernel oops messages with RIP pointing to mac80211 mesh management code paths
High volume of mesh CSA action frames from unusual peer addresses

Detection Strategies

Monitor kernel logs for NULL pointer dereference messages referencing mac80211 or mesh-related functions
Implement network-level inspection for malformed 802.11s mesh action frames missing required IEs
Deploy endpoint detection rules to alert on repeated kernel crashes with mesh networking stack traces
Use wireless intrusion detection systems (WIDS) to identify anomalous mesh management frame patterns

Monitoring Recommendations

Enable kernel crash dump collection to capture oops messages for forensic analysis
Configure syslog alerting for mesh-related kernel warnings and errors
Monitor mesh peer link states for unexpected disconnections following CSA frame reception
Track wireless interface stability metrics on mesh-enabled devices

How to Mitigate CVE-2026-23279

Immediate Actions Required

Apply the kernel patches from the stable kernel tree immediately on all affected systems
Consider temporarily disabling mesh networking if patching is not immediately possible
Restrict mesh peer link establishment to trusted devices using mesh security authentication
Update kernel to a patched version that includes the NULL check fix

Patch Information

The fix adds a NULL check for mesh_chansw_params_ie after the mesh_matches_local() validation returns, consistent with how other optional IEs are guarded throughout the mesh code. Multiple patches have been released for different kernel branches:

Workarounds

Disable mesh networking functionality if not required by unloading the mac80211 module or disabling mesh configuration
Implement wireless access control to restrict which devices can establish mesh peer links
Use secured mesh authentication (SAE) to prevent unauthorized peers from joining the mesh network
Deploy network segmentation to isolate mesh-enabled devices from critical infrastructure

bash

# Disable mesh point interface (temporary workaround)
iw dev mesh0 del

# Or prevent mesh module loading
echo "blacklist mac80211" >> /etc/modprobe.d/blacklist-mesh.conf

# Check current kernel version
uname -r

# Update to patched kernel (Debian/Ubuntu example)
apt update && apt upgrade linux-image-generic