CVE-2026-23396: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23396 Overview

A NULL pointer dereference vulnerability exists in the Linux kernel's mac80211 WiFi subsystem within the mesh_matches_local() function. The function unconditionally dereferences ie->mesh_config to compare mesh configuration parameters without first validating that the pointer is non-NULL. When the function is called from mesh_rx_csa_frame(), parsed action-frame elements may not contain a Mesh Configuration Information Element (IE), leaving ie->mesh_config NULL and triggering a kernel crash.

Critical Impact

An adjacent attacker can crash the Linux kernel by sending a crafted Channel Switch Announcement (CSA) action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE, causing a denial of service condition on systems running WiFi mesh networking.

Affected Products

• Linux kernel with WiFi mesh networking (mac80211 subsystem)
• Systems using 802.11s WiFi mesh network configurations
• Embedded devices and routers running Linux-based mesh networking

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-23396 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-23396

Vulnerability Analysis

The vulnerability resides in the mesh_matches_local() function located in net/mac80211/mesh.c. This function is responsible for comparing mesh configuration parameters to determine if a received frame matches the local mesh configuration. The core issue is that mesh_matches_local() assumes the ie->mesh_config pointer is always valid and proceeds to dereference it without any NULL check.

While two of the three callers of this function—ieee80211_mesh_rx_bcn_presp() and mesh_plink_get_event() (via mesh_process_plink_frame())—properly validate that elems->mesh_config is non-NULL before calling the function, the third caller, mesh_rx_csa_frame(), passes raw parsed elements directly without this guard. This creates an exploitable condition when processing crafted CSA action frames.

The crash manifests as a general protection fault due to accessing a non-canonical address in the NULL pointer dereference range (0x0000000000000000-0x0000000000000007), as captured in the kernel crash log showing the call trace through ieee80211_mesh_rx_queued_mgmt, ieee80211_iface_work, and cfg80211_wiphy_work.

Root Cause

The root cause is a missing NULL pointer validation in the mesh_matches_local() function. The function unconditionally accesses ie->mesh_config to compare mesh parameters, but when invoked via the mesh_rx_csa_frame() code path, the parsed action frame elements may legitimately lack a Mesh Configuration IE. The absence of a defensive NULL check at the function entry point allows crafted frames to trigger the NULL pointer dereference.

Attack Vector

An attacker within adjacent network range (radio proximity for WiFi) can exploit this vulnerability by transmitting a specially crafted 802.11 Channel Switch Announcement (CSA) action frame. The malicious frame must include a valid Mesh ID Information Element to pass initial parsing, but deliberately omit the Mesh Configuration IE. When the target system's mac80211 subsystem processes this frame through mesh_rx_csa_frame(), it calls mesh_matches_local() with a NULL mesh_config pointer, immediately causing a kernel panic and system crash.

The attack requires:

1. Physical proximity to the target WiFi mesh network
2. Ability to inject 802.11 management frames
3. Target system actively participating in mesh networking

The fix adds a NULL check for ie->mesh_config at the top of mesh_matches_local() to return false early when the Mesh Configuration IE is absent, preventing the NULL dereference.

Detection Methods for CVE-2026-23396

Indicators of Compromise

• Kernel crash logs showing NULL pointer dereference in mesh_matches_local() or related mac80211 mesh functions
• System logs with KASAN reports indicating null-ptr-deref in the address range 0x0000000000000000-0x0000000000000007
• Unexpected system reboots on devices running WiFi mesh networking
• Call traces referencing ieee80211_mesh_rx_queued_mgmt, ieee80211_iface_work, or cfg80211_wiphy_work

Detection Strategies

• Monitor kernel logs for oops or panic events related to mac80211 or mesh networking subsystems
• Deploy network intrusion detection systems to identify anomalous 802.11 CSA action frames with missing Mesh Configuration IEs
• Enable kernel crash dump analysis to capture NULL pointer dereference events in WiFi subsystems
• Use wireless frame analysis tools to detect malformed mesh management frames on the network

Monitoring Recommendations

• Configure continuous monitoring of /var/log/kern.log and dmesg output for mac80211-related crashes
• Implement alerting on unexpected system restarts for mesh-enabled network devices
• Enable KASAN (Kernel Address Sanitizer) in development environments to catch NULL dereferences early
• Monitor WiFi infrastructure for unusual management frame patterns from unknown sources

How to Mitigate CVE-2026-23396

Immediate Actions Required

• Update the Linux kernel to a patched version containing the NULL check fix for mesh_matches_local()
• Review all mesh-enabled wireless network devices for applicable kernel updates
• Consider temporarily disabling WiFi mesh networking on critical systems until patches are applied
• Monitor for unusual wireless activity or system crashes on mesh-enabled devices

Patch Information

The vulnerability has been addressed through multiple kernel commits that add a NULL check for ie->mesh_config at the top of mesh_matches_local() to return false early when the Mesh Configuration IE is absent. The following commits contain the fix:

• Kernel Commit 0a4da176
• Kernel Commit 44699c6c
• Kernel Commit 7c55a3de
• Kernel Commit a90279e7
• Kernel Commit c1e3f241
• Kernel Commit c73bb9a2

Workarounds

• Disable WiFi mesh networking functionality if not required for operations
• Implement network segmentation to limit adjacent attacker access to mesh-enabled devices
• Use wireless intrusion prevention systems to filter suspicious management frames
• Restrict physical access to areas where mesh networking is deployed

# Configuration example
# Disable mesh networking on wireless interface (temporary workaround)
iw dev wlan0 set type managed

# Check current interface mode
iw dev wlan0 info | grep type

# Remove mesh interface if dedicated mesh point exists
iw dev mesh0 del

# Verify kernel version and check for patches
uname -r