CVE-2026-31394 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-31394 PUBLISHED

In the Linux kernel, the following vulnerability has been resolved: mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations ieee80211_chan_bw_change() iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never participates in chanctx reservations. This leaves link->reserved.oper zero-initialized with chan == NULL, causing a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA. Resolve the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data. [also change sta->sdata in ARRAY_SIZE even if it doesn't matter]

Affected Products

Vendor	Product	Versions
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
linux	linux_kernel	0, 0, 0

Timeline

Apr 3, 2026 CVE Published
Apr 7, 2026 CVE Updated
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory
Apr 28, 2026 Security Advisory

References

Open in Interactive Console →