CVE-2026-90344: wifi: mac80211: disconnect on CSA to channel 0
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: disconnect on CSA to channel 0
The refactor for the CSA parsing erroneously equates channel zero and no information present, leading it to ignore a CSA on an AP that advertises a switch to that (invalid) channel. This leads to not disconnecting, which we should. For Intel devices, this can lead to a firmware crash.
Fix this by using an int type for the channel number as well as the opclass, and using a (negative) value that cannot be encoded in the element to indicate it's not present.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
A Wi-Fi client must process a Channel Switch Announcement from an access point that advertises a switch to channel 0. The vulnerable parsing logic treats that invalid channel value as though channel information were absent and does not disconnect.
Which systems face the most serious impact?
Linux kernel systems using mac80211 Wi-Fi are affected by the flawed handling. Intel Wi-Fi devices may experience a firmware crash when the invalid channel switch is not handled by disconnecting.
What should be done if the fix cannot be applied immediately?
The provided data identifies the triggering condition but does not specify a configuration workaround. Avoid connecting to or operating access points that can advertise an invalid Channel Switch Announcement to channel 0 until the kernel fix is deployed.