Executive brief
A vulnerability in the Linux kernel's wireless networking subsystem could allow a local user to cause a system crash. The issue occurs when the system handles specific Wi-Fi configurations, such as those used in bridged or VLAN-based wireless access points. This could lead to a denial-of-service, impacting the availability of the affected device and its network services.
Technical details
A NULL pointer dereference exists in the mac80211 wireless framework within the ieee80211_chan_bw_change() function. The vulnerability is triggered when the kernel iterates through stations on AP_VLAN interfaces (such as 4addr WDS clients). Because these stations point to VLAN-specific data that does not participate in channel context reservations, certain link pointers remain zero-initialized. When the system attempts to access these pointers during a Channel Switch Announcement (CSA), it triggers a crash in __ieee80211_sta_cap_rx_bw(). The fix involves correctly resolving the VLAN data to its parent Access Point data using get_bss_sdata() before accessing link information. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.11 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-05: patched: Initial patch authored by Felix Fietkau
- 2026-04-03: disclosed: CVE published
- 2026-05-20: advisory: NVD analysis completed