CVE-2026-31394 Linux CVE debrief

Who should care

Linux administrators, kernel maintainers, and platform teams running affected Linux kernel builds, especially systems that use mac80211-based wireless networking, AP_VLAN interfaces, 4addr/WDS clients, or channel switch announcement (CSA) workflows.

Technical summary

The kernel fix addresses a NULL pointer dereference in mac80211. In ieee80211_chan_bw_change(), station iteration can reach AP_VLAN stations whose sta->sdata points to the VLAN sdata instead of the parent AP sdata. That VLAN link never participates in chanctx reservations, so link->reserved.oper can remain zero-initialized with chan == NULL. When __ieee80211_sta_cap_rx_bw() later accesses chandef->chan->band during CSA, the NULL chan pointer can crash the kernel. NVD marks the weakness as CWE-476 and rates the issue CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). NVD also lists vulnerable Linux kernel ranges including versions starting at 6.11 before 6.12.78, starting at 6.13 before 6.18.20, starting at 6.19 before 6.19.10, and 7.0-rc1 through 7.0-rc4.

Defensive priority

Medium. The bug is locally triggered and requires low privileges, but it can cause a kernel crash and high availability impact on wireless hosts.

Recommended defensive actions

• Apply the upstream or stable kernel fixes referenced by NVD and your distribution vendor.
• Prioritize patching systems that use mac80211, AP_VLAN, 4addr/WDS, or CSA-dependent wireless configurations.
• If you rely on vendor kernels, verify that the fix has been backported rather than assuming the upstream version number alone is sufficient.
• Monitor affected hosts for unexpected kernel crashes or wireless stack instability until remediation is complete.

Evidence notes

Source description states that ieee80211_chan_bw_change() iterates stations and accesses link->reserved.oper via sta->sdata->link[link_id], but AP_VLAN stations point to VLAN sdata whose link does not participate in chanctx reservations. That leaves link->reserved.oper with chan == NULL and can lead to a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA. The described fix resolves the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data. NVD lists the record as analyzed, with CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-476, and provides vulnerable version criteria for affected Linux kernel releases.

Official resources