CVE-2026-31394 addresses a NULL pointer dereference vulnerability in the Linux kernel's mac80211 subsystem, specifically within the ieee80211_chan_bw_change function, affecting systems that use AP_VLAN stations like 4-address WDS clients during Channel Switch Announcement (CSA) operations. This flaw can lead to a system crash due to accessing uninitialized link data, though a CVSS score is not available and its FAUCET Risk Score is low at 20.0/100. There is no evidence of active exploitation, nor are any public exploit modules or proof-of-concept code available, with community discussion and media coverage being minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.11, < 6.12.78CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.13, < 6.18.20CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.19, < 6.19.10CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Linux kernel (Azure CVM) vulnerabilities
Jul 24, 2026Linux kernel (Azure FIPS) vulnerabilities
Jul 24, 2026Linux kernel (Azure CVM) vulnerabilities
Jul 24, 2026Linux kernel (Azure) vulnerabilities
Jul 24, 2026Linux kernel (AWS) vulnerabilities
Jul 24, 2026Linux kernel (NVIDIA) vulnerabilities
Jul 23, 2026Linux kernel (Oracle) vulnerabilities
Jul 23, 2026Linux kernel vulnerabilities
Jul 23, 2026Linux kernel (GCP FIPS) vulnerabilities
Jul 21, 2026Linux kernel vulnerabilities
Jul 20, 2026mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
Apr 2, 2026