CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

This patch is based on a BUG as reported by Bongani Hlope at

https://lore.kernel.org/all/[email protected]/

When a channel-switch announcement (CSA) beacon is received,

cfg80211 queues a wiphy work item that eventually calls

mt7921_channel_switch_rx_beacon(). If the station disconnects

(or the channel context is otherwise torn down) between the

time the work is queued and the time it runs, the driver's

dev->new_ctx pointer can already have been cleared to NULL.

mt7921_channel_switch_rx_beacon() then dereferences new_ctx

unconditionally, triggering a NULL pointer dereference at

address 0x0:

BUG: kernel NULL pointer dereference, address: 0000000000000000

RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common]

The same missing guard exists in mt7925_channel_switch_rx_beacon(),

which shares the same code pattern introduced by the same commit.

Add an early-return NULL check for dev->new_ctx in both

mt7921_channel_switch_rx_beacon() and

mt7925_channel_switch_rx_beacon(). When new_ctx is NULL there is

no pending channel switch to process, so returning immediately is

the correct and safe action.

Oops-Analysis: http://oops.fenrus.org/reports/lkml/[email protected]/report.html