The vulnerability resides in the mac80211 subsystem of the Linux kernel, where the ieee80211_chan_bw_change() routine accesses station link data that is uninitialized for AP_VLAN stations. This leads to a NULL pointer dereference when a channel switch announcement is processed, causing the kernel to panic. The result is a denial of service that can bring the entire system down. The weakness is a classic NULL pointer dereference scenario found in kernel code that handles wireless channel width changes.

All installations of the Linux kernel that include the mac80211 module prior to the commit that implements the fix are affected. The issue specifically impacts configurations that use AP_VLAN interfaces (4‑address WDS clients). No precise kernel version range is supplied, so any kernel build before the patch should be considered vulnerable.

CVSS and EPSS scores are not provided, and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data is limited. It is inferred that an attacker could trigger the crash by inducing a channel width change on an AP_VLAN station, likely via a crafted network frame sent over Wi‑Fi. Because the flaw leads to a kernel panic, the risk is significant, and the vulnerability presents a remote denial‑of‑service threat to affected hosts.