CVE-2026-64325 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/
When a channel-switch announcement (CSA) beacon is received, cfg80211 queues a wiphy work item that eventually calls mt7921_channel_switch_rx_beacon(). If the station disconnects (or the channel context is otherwise torn down) between the time the work is queued and the time it runs, the driver's dev->new_ctx pointer can already have been cleared to NULL. mt7921_channel_switch_rx_beacon() then dereferences new_ctx unconditionally, triggering a NULL pointer dereference at address 0x0:
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common]
The same missing guard exists in mt7925_channel_switch_rx_beacon(), which shares the same code pattern introduced by the same commit.
Add an early-return NULL check for dev->new_ctx in both mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). When new_ctx is NULL there is no pending channel switch to process, so returning immediately is the correct and safe action.
Oops-Analysis: http://oops.fenrus.org/reports/lkml/[email protected]/report.html
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability represents a critical NULL pointer dereference issue affecting the mt7921 and mt7925 wireless drivers within the Linux kernel's mac80211 subsystem. The flaw occurs during channel switching operations when a station receives a channel-switch announcement beacon while the wireless device is in a transitional state between channel contexts. The vulnerability stems from improper synchronization between asynchronous work item execution and potential disconnection events that can occur during the processing window.
The technical implementation involves the cfg80211 subsystem queuing wiphy work items to handle channel switch announcements through the mt7921_channel_switch_rx_beacon() function. When a station disconnects or the channel context is torn down between the queuing and execution of this work item, the driver's dev->new_ctx pointer becomes NULL while the beacon processing function still attempts to dereference it unconditionally. This creates an immediate system crash scenario with a kernel NULL pointer dereference at address zero, which manifests as a kernel oops condition that terminates normal system operation.
The vulnerability directly maps to CWE-476 which describes NULL Pointer Dereference in software systems where programs attempt to access memory through null pointers without proper validation. The flaw exhibits characteristics consistent with race conditions and improper state management within the wireless driver framework, specifically in how channel context transitions are handled during asynchronous processing operations. The issue affects both mt7921 and mt7925 driver variants due to their shared codebase pattern, indicating a systemic design flaw rather than isolated component failure.
Operationally, this vulnerability can be exploited by malicious actors who can trigger disconnection events while channel switching is in progress, potentially causing denial of service conditions that impact wireless connectivity for affected devices. The impact extends beyond simple disruption as it represents a potential kernel crash vector that could allow for system instability or complete device lockup during wireless network operations. This vulnerability particularly affects systems using MediaTek mt7921 and mt7925 wireless chipsets where the driver is actively managing channel switches.
The mitigation strategy involves implementing early return checks for NULL pointer validation in both affected functions before any dereference operations occur. The fix adds conditional logic to check dev->new_ctx for NULL values and return immediately when no valid context exists, preventing the kernel from attempting to access freed memory locations. This defensive programming approach follows established security practices for handling asynchronous operations where state can change between queueing and execution phases. The solution aligns with ATT&CK framework techniques related to system integrity protection through proper null pointer validation, specifically addressing the T1486 technique of system binary modification through kernel-level vulnerabilities.
The patch implementation demonstrates proper defensive programming practices that should be applied across similar driver codebases where asynchronous work items process state that can become invalid between queuing and execution. This vulnerability highlights the importance of validating all pointer references in kernel space, particularly in wireless drivers where timing-sensitive operations and multiple concurrent processes can lead to race conditions. The fix ensures that channel switching operations gracefully handle cases where the underlying channel context is no longer valid, preventing system crashes while maintaining proper network functionality through appropriate error handling mechanisms.