Description
In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix data race and NULL deref on local->assoc_dev

local->assoc_dev is shared between the association path and the
association-response worker without common synchronization.

mac802154_perform_association() stores the coordinator pointer and waits
for a response. Its timeout and error paths clear the pointer and return
to mac802154_associate(), which may then free the coordinator object.
Meanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit
and enter mac802154_process_association_resp(), which dereferences
assoc_dev.

The worker's bit test and the handler's pointer dereference are not
atomic with respect to cleanup. Cleanup can clear assoc_dev between them,
causing a NULL dereference, or free the coordinator while the response
handler still uses the pointer.

The recorded result is exposed to the same window. assoc_status and
assoc_addr are written by the handler but read by the association path
while the associating bit is still set, so a second response for the same
request - a malicious one, for instance - can replace them between those
reads and leave the caller with an incoherent status and address pair.

The response handler only needs the coordinator extended address.
Replace assoc_dev with a cached address, removing the pointer lifetime
dependency. Protect the cached address and the associating bit with a
dedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee
an atomic __le64 access on all 32-bit architectures.

wpan_dev->association_lock cannot be reused here: nl802154_associate()
holds it across rdev_associate(), hence for the whole of
mac802154_perform_association() including the wait for the response.
A response handler taking that lock would only get it once the
association has already given up.

Reset the completion, publish the cached address, and set the associating
bit while holding the lock. The response handler takes the lock, rechecks
the bit and the cached address, records the response, clears the bit, and
only then completes the waiter. Thus cleanup cannot pass the handler
between its state check and completion, and the cached 64-bit value
cannot tear.

The handler clears the bit before completing, not the woken waiter:
otherwise complete() is issued under the lock and a second (e.g.
malicious) response can reacquire it before the waiter and replace the
result. So a wait that returns success implies the bit is already clear,
and the success and negative-response paths return directly. The
transmit-error and timeout paths still clear it under assoc_lock, which
serializes any racing response against the cleanup while the call returns
the error it already selected. Both paths snapshot assoc_status and
assoc_addr under the same lock.

Both users run in process context, so a plain spinlock is sufficient.
The lock is not held while waiting for the completion.
Published: 2026-10-28
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel Crash (NULL Dereference)
Action: Patch Now
AI Analysis

Impact

A race condition exists in the Linux mac802154 driver where the association path and the association-response worker access the same pointer, local->assoc_dev, without proper synchronization. The association routine sets the pointer and later may clear or free it while the worker can simultaneously read it. If the pointer is cleared between a bit test and dereference, a NULL pointer dereference occurs, causing a kernel crash. Additionally, the worker can overwrite the association status and address, creating inconsistent network state that could be exploited to disrupt communications.

Affected Systems

All Linux kernel releases that include the mac802154 driver before the patch commits cdd8b1, a585901, and c037915 are affected. The issue is independent of distribution or kernel sub-version; any distribution running an unpatched kernel will be vulnerable whenever the mac802154 driver is active.

Risk and Exploitability

The CVSS score is not provided, but the vulnerability can lead to a kernel crash, a high‑impact denial of service. The EPSS score is unavailable, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a local or privileged user with the capability to transmit crafted IEEE 802.15.4 frames, as the race is triggered by the timing of an association response. Once the kernel crashes, any code running on the system is terminated, meaning that the severity is high for systems that remain running the vulnerable code.

Generated by OpenCVE AI on October 28, 2026 at 12:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the patches from commits cdd8b1, a585901, and c037915; the patch replaces the shared pointer with a cached address protected by a spinlock and removes the NULL dereference.
  • If an immediate kernel upgrade is not feasible, compile the kernel without the mac802154 driver or disable the driver/module at boot so that no association handling can occur.
  • If disabling the driver is not possible, block all IEEE 802.15.4 traffic on the device to eliminate the race window until the kernel update can be applied.

Generated by OpenCVE AI on October 28, 2026 at 12:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-476

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local->assoc_dev local->assoc_dev is shared between the association path and the association-response worker without common synchronization. mac802154_perform_association() stores the coordinator pointer and waits for a response. Its timeout and error paths clear the pointer and return to mac802154_associate(), which may then free the coordinator object. Meanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit and enter mac802154_process_association_resp(), which dereferences assoc_dev. The worker's bit test and the handler's pointer dereference are not atomic with respect to cleanup. Cleanup can clear assoc_dev between them, causing a NULL dereference, or free the coordinator while the response handler still uses the pointer. The recorded result is exposed to the same window. assoc_status and assoc_addr are written by the handler but read by the association path while the associating bit is still set, so a second response for the same request - a malicious one, for instance - can replace them between those reads and leave the caller with an incoherent status and address pair. The response handler only needs the coordinator extended address. Replace assoc_dev with a cached address, removing the pointer lifetime dependency. Protect the cached address and the associating bit with a dedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee an atomic __le64 access on all 32-bit architectures. wpan_dev->association_lock cannot be reused here: nl802154_associate() holds it across rdev_associate(), hence for the whole of mac802154_perform_association() including the wait for the response. A response handler taking that lock would only get it once the association has already given up. Reset the completion, publish the cached address, and set the associating bit while holding the lock. The response handler takes the lock, rechecks the bit and the cached address, records the response, clears the bit, and only then completes the waiter. Thus cleanup cannot pass the handler between its state check and completion, and the cached 64-bit value cannot tear. The handler clears the bit before completing, not the woken waiter: otherwise complete() is issued under the lock and a second (e.g. malicious) response can reacquire it before the waiter and replace the result. So a wait that returns success implies the bit is already clear, and the success and negative-response paths return directly. The transmit-error and timeout paths still clear it under assoc_lock, which serializes any racing response against the cleanup while the call returns the error it already selected. Both paths snapshot assoc_status and assoc_addr under the same lock. Both users run in process context, so a plain spinlock is sufficient. The lock is not held while waiting for the completion.
Title mac802154: fix data race and NULL deref on local->assoc_dev
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-28T10:34:47.193Z

Reserved: 2026-09-25T10:25:14.394Z

Link: CVE-2026-99134

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T11:17:33.260

Modified: 2026-10-28T11:17:33.260

Link: CVE-2026-99134

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T12:15:14Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-476

    NULL Pointer Dereference