SB2026100730 - NULL pointer dereference in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-98335)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mac80211 mesh channel-switch finalization when a mesh interface leaves the mesh with a channel switch still active. A local user can trigger departure from the mesh during an active channel switch to cause a denial of service.

Leaving the mesh releases the channel context, but pending channel-switch finalization work subsequently attempts to rebuild the mesh beacon.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2e1d6e80148495e728a85a9250176f266312e55c
• https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9
• https://git.kernel.org/stable/c/bc544ef02327edf61c94d2b6bae9d14b217009b2
• https://git.kernel.org/stable/c/d222fdc973bb8dbf0357772bd9042ffdc8291939