CVE-2026-98335: wifi: mac80211: abort chanswitch when leaving a mesh
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: abort chanswitch when leaving a mesh
The code in ieee80211stopmesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:ieee80211putsrateselem+0x42/0x640 net/mac80211/util.c:3272 Call Trace: ieee80211meshbuildbeacon+0xa83/0x1b50 net/mac80211/mesh.c:1093 ieee80211meshrebuildbeacon+0xc7/0x170 net/mac80211/mesh.c:1147 ieee80211meshfinishcsa+0x131/0x210 net/mac80211/mesh.c:1542 ieee80211setaftercsabeacon net/mac80211/cfg.c:4085 [inline] ieee80211csafinalize net/mac80211/cfg.c:4133 [inline] ieee80211csafinalize+0x633/0x1150 net/mac80211/cfg.c:4155 cfg80211wiphywork+0x2ab/0x450 net/wireless/core.c:438
Abort the channel switch properly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Compensating control
Abort the channel switch properly when leaving a mesh to prevent CSA finalization after the channel context has been released.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's mac80211 mesh functionality are exposed when a channel switch announcement is active. The described failure occurs during departure from a mesh.
What does an attacker or triggering event need to do?
A channel switch must remain active while the device leaves the mesh. The subsequent channel-switch finalization work can then access released channel-context state and crash.
What is the practical impact?
The reported outcome is a kernel Oops involving a null-pointer dereference during CSA finalization, which can cause a system crash or loss of wireless mesh functionality.
How can I recognize this failure?
Kernel logs may show a general protection fault or KASAN null-pointer dereference, with frames including ieee80211_put_srates_elem, ieee80211_mesh_build_beacon, ieee80211_mesh_finish_csa, and ieee80211_csa_finalize.