PT-2026-64546 · Linux · Linux
CVE-2026-64325
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
This patch is based on a BUG as reported by Bongani Hlope at
https://lore.kernel.org/all/20260502125824.425d7159@bongani-mini.home.org.za/
When a channel-switch announcement (CSA) beacon is received,
cfg80211 queues a wiphy work item that eventually calls
mt7921 channel switch rx beacon(). If the station disconnects
(or the channel context is otherwise torn down) between the
time the work is queued and the time it runs, the driver's
dev->new ctx pointer can already have been cleared to NULL.
mt7921 channel switch rx beacon() then dereferences new ctx
unconditionally, triggering a NULL pointer dereference at
address 0x0:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:mt7921 channel switch rx beacon+0x1f/0x100 [mt7921 common]
The same missing guard exists in mt7925 channel switch rx beacon(),
which shares the same code pattern introduced by the same commit.
Add an early-return NULL check for dev->new ctx in both
mt7921 channel switch rx beacon() and
mt7925 channel switch rx beacon(). When new ctx is NULL there is
no pending channel switch to process, so returning immediately is
the correct and safe action.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux