CVE-2026-23367: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23367 is an uninitialized pointer dereference vulnerability in the Linux kernel's Wi-Fi radiotap parser that allows a local low-privileged attacker to cause a denial of service. The flaw exists in the radiotap iterator logic, where use of the undefined radiotap field 18 leaves iterator->_next_ns_data uninitialized, which is subsequently compared against — a condition identified by syzbot. Affected Linux kernel versions span from 2.6.34.1 through multiple stable series, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2 and later. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-824 (Access of Uninitialized Pointer). The radiotap parser in the Linux kernel's Wi-Fi subsystem (net/wireless/radiotap.c) only initializes iterator->_next_ns_data when processing vendor namespaces; however, when an undefined field (field 18) is encountered, the parser proceeds without initializing this pointer and later compares against it, resulting in undefined behavior. The fix relocates the rejection of unknown radiotap fields to after the in-namespace lookup, ensuring _next_ns_data is only accessed in the vendor namespace context. The vulnerability requires local access and low privileges to trigger by crafting or injecting malformed radiotap packets with undefined field 18 (Red Hat CVE, Feedly).

Successful exploitation allows a local attacker with low privileges to trigger a kernel crash or memory corruption via an uninitialized pointer dereference, resulting in a denial of service. There is no confidentiality or integrity impact; the primary risk is system availability loss. In environments where kernel stability is critical (e.g., embedded wireless systems, network appliances), repeated exploitation could cause persistent outages (Red Hat CVE, Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing the radiotap iterator or net/wireless/radiotap.c, particularly involving null or garbage pointer dereferences.
• Process/System: Unexpected system reboots or kernel crashes on systems with Wi-Fi interfaces active; kernel BUG or WARNING traces involving ieee80211_radiotap_iterator_next.
• Network: Unusual or malformed 802.11 radiotap-encapsulated frames captured on monitor-mode interfaces, particularly those containing undefined field 18 in the radiotap header.

Update the Linux kernel to a patched version: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc2 and later. Patches are available via the kernel.org stable branches and have been incorporated into downstream distributions including Debian (DSA-6243-1, DLA-4561-1) and SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1). As a temporary workaround where patching is not immediately possible, restrict local user access to Wi-Fi interfaces and monitor for kernel crash events (Red Hat CVE, SUSE Advisory, Debian Advisory).

The vulnerability was flagged by Debian, SUSE, and the Yocto Project security teams, each issuing advisories and updated kernel packages. Detection coverage has been added by Tenable (Nessus plugin 311783) and Qualys (detection IDs 762889, 762916, 762925), indicating broad scanner adoption. No notable researcher commentary or social media discussion beyond standard advisory channels has been observed (Debian Advisory, SUSE Advisory, Tenable).