SB2026032651 - NULL pointer dereference in Linux kernel mac80211

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026032651

SB2026032651 - NULL pointer dereference in Linux kernel mac80211

Published: March 26, 2026

Security Bulletin ID SB2026032651
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Physical access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) NULL pointer dereference (CVE-ID: CVE-2026-23396)

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to improper pointer dereference in the mesh_matches_local() function in the Linux kernel's mac80211 subsystem when handling Wi-Fi mesh action frames. An attacker with physical access can send a specially crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE to cause a kernel NULL pointer dereference, resulting in a system crash.

The vulnerability specifically affects Wi-Fi mesh mode processing and requires the attacker to be within radio range to transmit the malicious frame. No authentication or user interaction is required for exploitation.


Remediation

Install update from vendor's website.

References