CVE-2026-23040 in Linux
Summary
by MITRE • 02/04/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: fix typo in frequency notification
The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel. This could result in a NULL pointer dereference in cfg80211_next_nan_dw_notif.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability CVE-2026-23040 represents a critical typo in the Linux kernel's mac80211_hwsim wireless subsystem that could lead to a NULL pointer dereference during IEEE 802.11 NAN (Neighbor Awareness Networking) frequency notifications. This issue specifically affects the hardware simulator component used for testing wireless drivers and networking functionality within the kernel. The flaw manifests when the system attempts to process NAN notifications for a frequency that does not correspond to a valid wireless channel, creating a dangerous condition that could crash the kernel or potentially be exploited by malicious actors. The vulnerability stems from an incorrect frequency value of 5475 MHz being used instead of the proper 5745 MHz, which corresponds to channel 149 in the 5 GHz wireless band. This type of error falls under the CWE-1214 category of improper handling of invalid data, specifically related to incorrect frequency values in wireless communication protocols.
The technical implementation of this vulnerability occurs within the cfg80211_next_nan_dw_notif function where the kernel attempts to process NAN dwell time notifications for wireless networks. When the system receives a malformed frequency notification with the incorrect value of 5475 MHz, it fails to properly validate this invalid channel frequency against the valid wireless channel ranges. This invalid frequency does not correspond to any legitimate IEEE 802.11 channel in the 5 GHz band, which ranges from 5180 MHz to 5825 MHz with specific channel spacing. The kernel's wireless subsystem then attempts to dereference a NULL pointer when processing this invalid notification, leading to a kernel panic or system crash. This behavior directly violates the principle of input validation and proper error handling in kernel space operations, creating a potential denial of service condition that could affect wireless networking functionality across affected systems.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise wireless network stability and availability in environments where the mac80211_hwsim module is actively used. Systems that rely on wireless testing frameworks, virtualized wireless environments, or development platforms using hardware simulators would be particularly susceptible to this issue. The vulnerability could be exploited in scenarios where an attacker can influence wireless frequency notifications, potentially leading to system instability or denial of service conditions that affect network connectivity. In enterprise environments where wireless infrastructure testing is common, this could result in significant operational disruptions. The ATT&CK framework would classify this as a kernel-level vulnerability under the T1068 technique of "Exploitation for Privilege Escalation" or T1499 under "Network Denial of Service" depending on the exploitation method. The vulnerability demonstrates the critical importance of proper input validation and error handling in kernel space operations, where a single incorrect value can lead to system-wide failures.
Mitigation strategies for CVE-2026-23040 should focus on applying the appropriate kernel security patches that correct the frequency value from 5475 MHz to the proper 5745 MHz for channel 149 notifications. System administrators should prioritize updating their kernel versions to include the fixed implementation of the mac80211_hwsim module, particularly in development environments or testing platforms that utilize wireless hardware simulators. Additionally, implementing proper monitoring and alerting for kernel crashes or wireless subsystem failures can help detect potential exploitation attempts. Network administrators should also consider disabling unused wireless testing modules in production environments to reduce the attack surface. The fix should include enhanced validation routines that verify frequency values against legitimate wireless channel ranges before processing notifications, implementing proper bounds checking and error handling in the cfg80211_next_nan_dw_notif function. Organizations should conduct thorough testing of kernel updates in staging environments to ensure compatibility with existing wireless infrastructure and testing frameworks before deployment to production systems.