CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon<br /> <br /> This patch is based on a BUG as reported by Bongani Hlope at<br /> https://lore.kernel.org/all/20260502125824.425d7159@bongani-mini.home.org.za/<br /> <br /> When a channel-switch announcement (CSA) beacon is received,<br /> cfg80211 queues a wiphy work item that eventually calls<br /> mt7921_channel_switch_rx_beacon(). If the station disconnects<br /> (or the channel context is otherwise torn down) between the<br /> time the work is queued and the time it runs, the driver&amp;#39;s<br /> dev-&gt;new_ctx pointer can already have been cleared to NULL.<br /> mt7921_channel_switch_rx_beacon() then dereferences new_ctx<br /> unconditionally, triggering a NULL pointer dereference at<br /> address 0x0:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common]<br /> <br /> The same missing guard exists in mt7925_channel_switch_rx_beacon(),<br /> which shares the same code pattern introduced by the same commit.<br /> <br /> Add an early-return NULL check for dev-&gt;new_ctx in both<br /> mt7921_channel_switch_rx_beacon() and<br /> mt7925_channel_switch_rx_beacon(). When new_ctx is NULL there is<br /> no pending channel switch to process, so returning immediately is<br /> the correct and safe action.<br /> <br /> Oops-Analysis: http://oops.fenrus.org/reports/lkml/20260502125824.425d7159@bongani-mini.home.org.za/report.html