A null pointer dereference occurs in the mac80211 subsystem of the Linux kernel when an AP_VLAN station undergoes a channel width change. During the transition, the driver accesses link data that is uninitialized for VLAN interfaces, leading to a dereference of a null pointer in __ieee80211_sta_cap_rx_bw(). The result is a kernel panic, which manifests as a system crash or reboot.

The vulnerability affects Linux kernel implementations that contain the unpatched mac80211 code and operate with AP_VLAN (4‑address WDS) interfaces. Because no specific version range is listed, any kernel prior to the application of the fix commit is potentially vulnerable. The vendor is Linux and the product is the Linux kernel.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of 0.00025 (<1%) suggests a low but non‑zero probability of exploitation, but it is not listed in CISA’s KEV catalog. The likely attack vector is through crafted IEEE 802.11 traffic directed at the vulnerable driver; an attacker would need to send such traffic to a device running the affected kernel. The vulnerability does not provide a path to remote code execution, but it can cause a denial of service by crashing the system.