-

CVE-2026-98335

wifi: mac80211: abort chanswitch when leaving a mesh

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: abort chanswitch when leaving a mesh

The code in ieee80211_stop_mesh() leaves CSA active, but leaving
the mesh released the channel context, so the CSA finalize work
crashes:

  Oops: general protection fault, probably for non-canonical address
        0xdffffc0000000003
  KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
  RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272
  Call Trace:
   ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093
   ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147
   ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542
   ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline]
   __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline]
   ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155
   cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438

Abort the channel switch properly.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version b8456a14e9d2770846fcf74de18ff95b676149a3
Version < bc544ef02327edf61c94d2b6bae9d14b217009b2
Status affected
Version b8456a14e9d2770846fcf74de18ff95b676149a3
Version < 2e1d6e80148495e728a85a9250176f266312e55c
Status affected
Version b8456a14e9d2770846fcf74de18ff95b676149a3
Version < d222fdc973bb8dbf0357772bd9042ffdc8291939
Status affected
Version b8456a14e9d2770846fcf74de18ff95b676149a3
Version < ac7472a24bd433b81c06582835dd1d5547c10da9
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.13
Status affected
Version 0
Version < 3.13
Status unaffected
Version <= 6.12.*
Version 6.12.112
Status unaffected
Version <= 6.18.*
Version 6.18.54
Status unaffected
Version <= 7.2.*
Version 7.2.8
Status unaffected
Version <= *
Version 7.3-rc4
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.064
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/bc544ef02327edf61c94d2b6bae9d14b217009b2
https://git.kernel.org/stable/c/2e1d6e80148495e728a85a9250176f266312e55c
https://git.kernel.org/stable/c/d222fdc973bb8dbf0357772bd9042ffdc8291939
https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9