CVE-2026-31394 mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
A NULL pointer dereference in the Linux kernel mac80211 subsystem allows attackers to cause a system crash via crafted Wi-Fi channel switch announcements.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31394?
CVE-2026-31394 is a medium-severity vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
ieee80211_chan_bw_change() iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never participates in chanctx reservations. This leaves link->reserved.oper zero-initialized with chan == NULL, causing a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA.
Resolve the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data.
[also change sta->sdata in ARRAY_SIZE even if it doesn't matter]
Weakness: CWE-476
Which versions are affected by CVE-2026-31394?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31394?
Apply the vendor's patch.
Is CVE-2026-31394 being exploited?
There is no known exploitation of CVE-2026-31394 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31394, DEBIAN-CVE-2026-31394, GHSA-96f2-8m7p-q7j4, ROOT-OS-DEBIAN-11-CVE-2026-31394, ROOT-OS-DEBIAN-12-CVE-2026-31394, ROOT-OS-DEBIAN-13-CVE-2026-31394 and 3 more.