Riskcovery

CVE-2026-31394

mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations

State
Published
Severity
Not scored
Published
Apr 3, 2026
Updated
May 11, 2026
Reserved
Mar 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations

ieee80211_chan_bw_change() iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never participates in chanctx reservations. This leaves link->reserved.oper zero-initialized with chan == NULL, causing a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA.

Resolve the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data.

[also change sta->sdata in ARRAY_SIZE even if it doesn't matter]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b27512368591fc959768df1f7dacf2a96b1bd036 to before 65c25b588994dd422fea73fa322de56e1ae4a33bAffected
  • b27512368591fc959768df1f7dacf2a96b1bd036 to before 5a86d4e920d9783a198e39cf53f0e410fba5fbd6Affected
  • b27512368591fc959768df1f7dacf2a96b1bd036 to before 3c6629e859a2211a1fbb4868f915413f80001ca5Affected
  • b27512368591fc959768df1f7dacf2a96b1bd036 to before 672e5229e1ecfc2a3509b53adcb914d8b024a853Affected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.78 through 6.12.*Not affected
  • 6.18.20 through 6.18.*Not affected
  • 6.19.10 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.