CVE-2026-31394: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31394 is a NULL pointer dereference vulnerability in the Linux kernel's mac80211 wireless subsystem, specifically within the ieee80211_chan_bw_change() function when handling AP_VLAN stations (e.g., 4-address WDS clients). The flaw was published on April 3, 2026, and affects Linux kernel versions 6.11 through 6.12.77, 6.13 through 6.18.19, and 6.19 through 6.19.9, as well as pre-release 7.0-rc1 through 7.0-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in ieee80211_chan_bw_change(), which iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces, sta->sdata points to the VLAN sdata whose link never participates in chanctx reservations, leaving link->reserved.oper zero-initialized with chan == NULL. This causes a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during a Channel Switch Announcement (CSA). The fix resolves the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data (GitHub Advisory). The attack vector is local with low privileges required and no user interaction needed.

Successful exploitation causes a kernel crash (NULL pointer dereference), resulting in a denial of service affecting the wireless subsystem and potentially the entire system. The impact is limited to availability — there is no confidentiality or integrity impact. This vulnerability is particularly relevant in enterprise or infrastructure deployments utilizing Wireless Distribution System (WDS) configurations with 4-address mode clients, where a channel switch announcement can trigger the crash (Feedly).

Patches are available for multiple Linux kernel stable branches. Users should upgrade to kernel version 6.12.78, 6.18.20, 6.19.10, or 7.0-rc5 or later, which include the fix via get_bss_sdata() resolution before link data access (GitHub Advisory). Distribution-specific updates are available from SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) and Microsoft Azure Linux (azl3_kernel_6.6.130.1-3). As a temporary workaround, disabling AP_VLAN interfaces or 4-address WDS functionality — if not operationally critical — can mitigate the risk until patching is possible (Feedly).

The vulnerability was announced via the Linux kernel CVE announcement mailing list and tracked by multiple security vendors including Qualys, Tenable (Nessus plugin 304975), and SUSE. The Yocto Project security mailing list also discussed the issue in the context of embedded Linux distributions. No significant public researcher commentary or social media discussion has been observed, consistent with the low severity and limited exploitation potential of this kernel crash bug.