PT-2026-30177 · Linux · Linux Kernel

Published 2026-04-03 · Updated 2026-04-20 · CVE-2026-31394

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel's mac80211 component, specifically within the ieee80211 chan bw change() function. This function iterates through stations and accesses link->reserved.oper via sta->sdata->link[link id]. For stations on AP VLAN interfaces, sta->sdata points to a VLAN sdata, which doesn't participate in channel context reservations, leading to a zero-initialized link->reserved.oper with chan being NULL. This results in a NULL pointer dereference within ieee80211 sta cap rx bw() when accessing chandef->chan->band during Channel State Announcement (CSA).

Recommendations Resolve the VLAN sdata to its parent AP sdata using get bss sdata() before accessing link data.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-31394

Affected Products

Linux Kernel

References · 17

• https://git.kernel.org/stable/c/3c6629e859a2211a1fbb4868f915413f80001ca5 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-31394 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31394 · Security Note
• https://git.kernel.org/stable/c/672e5229e1ecfc2a3509b53adcb914d8b024a853 · Patch
• https://ubuntu.com/security/CVE-2026-31394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31394 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31394 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-31394 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31394 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31394 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-31394 · Vendor Advisory
• https://git.kernel.org/stable/c/65c25b588994dd422fea73fa322de56e1ae4a33b · Patch
• https://git.kernel.org/stable/c/5a86d4e920d9783a198e39cf53f0e410fba5fbd6 · Patch
• https://git.kernel.org/linus/672e5229e1ecfc2a3509b53adcb914d8b024a853 · Note
• https://twitter.com/VulmonFeeds/status/2040150929165426733 · Twitter Post