diff --git a/package/mac80211/patches/541-mac80211_fix_skb_copy_crash.patch b/package/mac80211/patches/541-mac80211_fix_skb_copy_crash.patch
new file mode 100644
index 00000000000..810df58506d
--- /dev/null
+++ b/package/mac80211/patches/541-mac80211_fix_skb_copy_crash.patch
@@ -0,0 +1,19 @@
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1748,7 +1748,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ {
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ieee80211_local *local = sdata->local;
+-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_tx_info *info;
+ 	int ret = NETDEV_TX_BUSY, head_need;
+ 	u16 ethertype, hdrlen,  meshhdrlen = 0;
+ 	__le16 fc;
+@@ -2039,6 +2039,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
+ 	skb_set_network_header(skb, nh_pos);
+ 	skb_set_transport_header(skb, h_pos);
+ 
++	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
+ 
+ 	dev->trans_start = jiffies;