PT-2026-64546 · Linux · Linux

CVE-2026-64325 · Publicado 2026-07-25 · Atualizado 2026-07-25

NVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[e-mail]/

When a channel-switch announcement (CSA) beacon is received, cfg80211 queues a wiphy work item that eventually calls mt7921 channel switch rx beacon(). If the station disconnects (or the channel context is otherwise torn down) between the time the work is queued and the time it runs, the driver's dev->new ctx pointer can already have been cleared to NULL. mt7921 channel switch rx beacon() then dereferences new ctx unconditionally, triggering a NULL pointer dereference at address 0x0:

BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:mt7921 channel switch rx beacon+0x1f/0x100 [mt7921 common]

The same missing guard exists in mt7925 channel switch rx beacon(), which shares the same code pattern introduced by the same commit.

Add an early-return NULL check for dev->new ctx in both mt7921 channel switch rx beacon() and mt7925 channel switch rx beacon(). When new ctx is NULL there is no pending channel switch to process, so returning immediately is the correct and safe action.

Oops-Analysis: http://oops.fenrus.org/reports/lkml/[e-mail]/report.html

Identificadores relacionados

CVE-2026-64325

Produtos afetados

Linux

Referências · 3

• https://git.kernel.org/stable/c/77e7b127472a191e086e1e0b1b051703f33b1801 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64325 · Nota de Segurança
• https://git.kernel.org/stable/c/351dd7d2c80d23e56dcce6faa4e62bea5b0877c7 · Nota