CVE-2026-31394 Linux CVE debrief

Who should care

Linux administrators, kernel maintainers, and platform teams running affected Linux kernel builds, especially systems that use mac80211-based wireless networking, AP_VLAN interfaces, 4addr/WDS clients, or channel switch announcement (CSA) workflows.

Technical summary

The kernel fix addresses a NULL pointer dereference in mac80211. In ieee80211_chan_bw_change(), station iteration can reach AP_VLAN stations whose sta->sdata points to the VLAN sdata instead of the parent AP sdata. That VLAN link never participates in chanctx reservations, so link->reserved.oper can remain zero-initialized with chan == NULL. When __ieee80211_sta_cap_rx_bw() later accesses chandef->chan->band during CSA, the NULL chan pointer can crash the kernel. NVD marks the weakness as CWE-476 and rates the issue CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). NVD also lists vulnerable Linux kernel ranges including versions starting at 6.11 before 6.12.78, starting at 6.13 before 6.18.20, starting at 6.19 before 6.19.10, and 7.0-rc1 through 7.0-rc4.

Defensive priority

Medium. The bug is locally triggered and requires low privileges, but it can cause a kernel crash and high availability impact on wireless hosts.

Recommended defensive actions

• Apply the upstream or stable kernel fixes referenced by NVD and your distribution vendor.
• Prioritize patching systems that use mac80211, AP_VLAN, 4addr/WDS, or CSA-dependent wireless configurations.
• If you rely on vendor kernels, verify that the fix has been backported rather than assuming the upstream version number alone is sufficient.
• Monitor affected hosts for unexpected kernel crashes or wireless stack instability until remediation is complete.

Evidence notes

Source description states that ieee80211_chan_bw_change() iterates stations and accesses link->reserved.oper via sta->sdata->link[link_id], but AP_VLAN stations point to VLAN sdata whose link does not participate in chanctx reservations. That leaves link->reserved.oper with chan == NULL and can lead to a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA. The described fix resolves the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data. NVD lists the record as analyzed, with CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-476, and provides vulnerable version criteria for affected Linux kernel releases.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.