CVE-2026-23040: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23040 is a NULL pointer dereference vulnerability in the Linux kernel's mac80211_hwsim Wi-Fi simulation driver, caused by a typo in a NAN (Neighbor Awareness Networking) frequency notification. The incorrect frequency value (5475 MHz instead of the correct 5745 MHz, corresponding to channel 149) is not a valid channel, which can trigger a NULL pointer dereference in cfg80211_next_nan_dw_notif. The vulnerability was published on February 4, 2026, and affects Linux kernel versions in the range from commit a37a6f54439bf82b827a7072415d3a4afa4e12bd up to the patched commits. It is estimated as Medium severity with an EPSS score of 0.000240 (Feedly, EUVD).

The root cause is a simple typographical error in the mac80211_hwsim kernel module where the NAN dual-band notification frequency is hardcoded as 5475 MHz instead of the correct 5745 MHz (channel 149, CWE-476: NULL Pointer Dereference). Because 5475 MHz does not correspond to a valid Wi-Fi channel, the cfg80211_next_nan_dw_notif function receives an invalid channel lookup result (NULL), and subsequently dereferences it without a NULL check. The fix is applied in two stable kernel commits: 1251bbdb8f5b2ea86ca9b4268a2e6aa34372ab33 and 333418872bfecf4843f1ded7a4151685dfcf07d5, correcting the frequency value to 5745 MHz (Kernel Git, Kernel Git).

Successful exploitation of this vulnerability could cause a kernel NULL pointer dereference, leading to a system crash (kernel panic) and denial of service on affected Linux systems. The impact is primarily limited to availability, as the crash would require a restart of the affected system. Because mac80211_hwsim is a simulation/testing driver typically used in development or virtualized environments rather than production wireless hardware, the real-world attack surface is relatively narrow (Feedly, EUVD).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2026-23040. The EPSS score is very low at 0.000240, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require the ability to trigger NAN-related operations on a system running the mac80211_hwsim module, which is primarily used in testing and simulation contexts (Feedly).

The vulnerability is fixed in Linux kernel stable releases patched at version 6.18.6 and 6.19-rc5, via commits 1251bbdb8f5b2ea86ca9b4268a2e6aa34372ab33 and 333418872bfecf4843f1ded7a4151685dfcf07d5. Red Hat has issued security advisories RHSA-2026:18134 and RHSA-2026:18587 addressing this issue for affected RHEL-based distributions. Users should update to a patched kernel version; as a workaround, unloading or blacklisting the mac80211_hwsim module on systems where it is not required will eliminate the attack surface (Red Hat Advisory, Red Hat Advisory, EUVD).