CVE-2026-99134 is a vulnerability in the Linux kernel's mac802154 subsystem involving a data race and NULL pointer dereference on the local->assoc_dev pointer. The flaw arises from unsynchronized access between association path and association-response worker, potentially causing use-after-free or NULL dereference conditions. The issue is addressed by replacing the pointer with a cached address protected by a dedicated spinlock to ensure atomic access and proper synchronization.