CVE-2026-64325 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
A remote attacker can cause a kernel crash by sending a crafted CSA beacon during a station disconnect, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64325?
CVE-2026-64325 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/
When a channel-switch announcement (CSA) beacon is received, cfg80211 queues a wiphy work item that eventually calls mt7921_channel_switch_rx_beacon(). If the station disconnects (or the channel context is otherwise torn down) between the time the work is queued and the time it runs, the driver's dev->new_ctx pointer can already have been cleared to NULL. mt7921_channel_switch_rx_beacon() then dereferences new_ctx unconditionally, triggering a NULL pointer dereference at address 0x0:
BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common]
The same missing guard exists in mt7925_channel_switch_rx_beacon(), which shares the same code pattern introduced by the same commit.
Add an early-return NULL check for dev->new_ctx in both mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). When new_ctx is NULL there is no pending channel switch to process, so returning immediately is the correct and safe action.
Oops-Analysis: http://oops.fenrus.org/reports/lkml/[email protected]/report.html
Weakness: CWE-476
Which versions are affected by CVE-2026-64325?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64325?
Apply the vendor's patch.
Is CVE-2026-64325 being exploited?
There is no known exploitation of CVE-2026-64325 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64325, DEBIAN-CVE-2026-64325, GHSA-6c49-xc7v-mqvw, ROOT-OS-UBUNTU-2204-CVE-2026-64325, UBUNTU-CVE-2026-64325.