In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: abort chanswitch when leaving a mesh

The code in ieee80211_stop_mesh() leaves CSA active, but leaving
the mesh released the channel context, so the CSA finalize work
crashes:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000003
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272
Call Trace:
ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093
ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147
ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542
ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline]
__ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline]
ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155
cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438

Abort the channel switch properly.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
b8456a14e9d2770846fcf74de18ff95b676149a3 affected < bc544ef02327edf61c94d2b6bae9d14b217009b2
b8456a14e9d2770846fcf74de18ff95b676149a3 affected < 2e1d6e80148495e728a85a9250176f266312e55c
b8456a14e9d2770846fcf74de18ff95b676149a3 affected < d222fdc973bb8dbf0357772bd9042ffdc8291939
b8456a14e9d2770846fcf74de18ff95b676149a3 affected < ac7472a24bd433b81c06582835dd1d5547c10da9
Linux Linux affected
Version Status Constraints
3.13 affected —
0 unaffected < 3.13
6.12.112 unaffected ≤ 6.12.*
6.18.54 unaffected ≤ 6.18.*
7.2.8 unaffected ≤ 7.2.*
7.3-rc4 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2e1d6e80148495e728a85a9250176f266312e55c cve-icon cve-icon
https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9 cve-icon cve-icon
https://git.kernel.org/stable/c/bc544ef02327edf61c94d2b6bae9d14b217009b2 cve-icon cve-icon
https://git.kernel.org/stable/c/d222fdc973bb8dbf0357772bd9042ffdc8291939 cve-icon cve-icon
History

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211_stop_mesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272 Call Trace: ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093 ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147 ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline] __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline] ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438 Abort the channel switch properly.
Title wifi: mac80211: abort chanswitch when leaving a mesh
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-06T08:46:26.816Z

Reserved: 2026-09-25T10:25:14.342Z

Link: CVE-2026-98335

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:26.040

Modified: 2026-10-06T09:18:26.040

Link: CVE-2026-98335

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.