CVE-2026-23396: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23396 is a NULL pointer dereference vulnerability in the Linux kernel's mac80211 WiFi subsystem, specifically within the mesh_matches_local() function. An adjacent attacker can trigger a kernel crash by sending a crafted Channel Switch Announcement (CSA) action frame containing a valid Mesh ID IE but omitting the Mesh Configuration IE, causing mesh_rx_csa_frame() to pass a NULL ie->mesh_config pointer to mesh_matches_local(). The vulnerability was published on March 26, 2026, and affects Linux kernel versions from 2.6.26 through multiple stable branches up to 7.0-rc7, as well as Microsoft Azure Linux kernel 6.6.126.1-1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a NULL pointer dereference (CWE-476) in net/mac80211/mesh.c. The function mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters without first checking whether the pointer is NULL. While the two other callers of this function (ieee80211_mesh_rx_bcn_presp() and mesh_plink_get_event() via mesh_process_plink_frame()) guard against a NULL mesh_config, mesh_rx_csa_frame() does not perform this check before invoking mesh_matches_local(). An attacker on the same wireless network segment can craft a CSA action frame that includes a Mesh ID IE but omits the Mesh Configuration IE, triggering the dereference and causing a kernel general protection fault, as evidenced by KASAN null-ptr-deref warnings in the crash log (Feedly).

Successful exploitation results in an immediate kernel NULL pointer dereference, crashing the affected system and causing a denial of service (DoS). There is no confidentiality or integrity impact — the vulnerability exclusively affects availability. Only systems with IEEE 802.11s mesh networking enabled are vulnerable, and the crash manifests as a general protection fault with KASAN null-ptr-deref warnings in kernel logs (Feedly).

1. Reconnaissance: Identify target systems running Linux kernel versions within the affected range (e.g., 5.10.x < 5.10.253, 6.6.x < 6.6.130, 6.12.x < 6.12.78) with IEEE 802.11s mesh networking enabled. Tools such as iw or passive wireless scanning can reveal mesh-capable interfaces.
2. Position on adjacent network: Gain physical or logical proximity to the target's wireless mesh network segment — the attacker must be able to transmit 802.11 management frames receivable by the target.
3. Craft malicious CSA action frame: Construct a Channel Switch Announcement (CSA) action frame that includes a valid Mesh ID IE but deliberately omits the Mesh Configuration IE. This can be done using raw 802.11 frame injection tools such as scapy or custom kernel modules.
4. Inject the frame: Transmit the crafted CSA action frame over the wireless medium toward the target mesh node.
5. Trigger kernel crash: The target's mesh_rx_csa_frame() handler parses the frame, passes the elements (with mesh_config == NULL) to mesh_matches_local(), which dereferences the NULL pointer, causing a kernel general protection fault and system crash (DoS) (Feedly).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing Oops: general protection fault or KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] with a call trace referencing mesh_matches_local (net/mac80211/mesh.c:65) and ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686).
• Logs: Workqueue entries in crash traces referencing events_unbound cfg80211_wiphy_work and ieee80211_iface_work.
• Network: Unexpected or malformed 802.11 CSA action frames received on mesh interfaces that include a Mesh ID IE but lack a Mesh Configuration IE — detectable via wireless packet capture (e.g., tcpdump, wireshark) on the mesh interface.
• System: Unexpected system reboots or kernel panics on hosts with active mesh networking interfaces (Feedly).

Apply the available kernel patches immediately. Fixed versions include: 5.10.253+, 5.15.203+, 6.1.167+, 6.6.130+, 6.12.78+, 6.18.20+, 6.19.10+, and 7.0+ releases. Patches are available via multiple stable kernel commits at kernel.org (e.g., 0a4da176ae4b, 14a4fd13657a, 44699c6cdfce, 74de6fa472b0, 7c55a3deaf7e, a90279e7f7ea, c1e3f2416fb2, c73bb9a2d33b). Microsoft Azure Linux users should update to a patched kernel version. As a temporary workaround, consider disabling IEEE 802.11s mesh networking on systems where it is not required until patching can be completed. Debian, SUSE, and other distributions have issued updated packages (Feedly, Microsoft MSRC).