Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon

This patch is based on a BUG as reported by Bongani Hlope at
https://lore.kernel.org/all/20260502125824.425d7159@bongani-mini.home.org.za/

When a channel-switch announcement (CSA) beacon is received,
cfg80211 queues a wiphy work item that eventually calls
mt7921_channel_switch_rx_beacon(). If the station disconnects
(or the channel context is otherwise torn down) between the
time the work is queued and the time it runs, the driver's
dev->new_ctx pointer can already have been cleared to NULL.
mt7921_channel_switch_rx_beacon() then dereferences new_ctx
unconditionally, triggering a NULL pointer dereference at
address 0x0:

BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common]

The same missing guard exists in mt7925_channel_switch_rx_beacon(),
which shares the same code pattern introduced by the same commit.

Add an early-return NULL check for dev->new_ctx in both
mt7921_channel_switch_rx_beacon() and
mt7925_channel_switch_rx_beacon(). When new_ctx is NULL there is
no pending channel switch to process, so returning immediately is
the correct and safe action.

Oops-Analysis: http://oops.fenrus.org/reports/lkml/20260502125824.425d7159@bongani-mini.home.org.za/report.html
Published: 2026-07-25
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A NULL pointer dereference occurs in the mt76 driver for the mt7921 and mt7925 chipsets when a channel-switch announcement beacon is processed after the device’s channel context has been torn down. The driver assumes a non‑NULL context pointer and dereferences it, causing the kernel to fault at address 0x0. This results in a kernel panic and system reboot, which effectively denies service to the affected system. The weakness is a classic NULL pointer dereference (CWE‑476).

Affected Systems

This vulnerability exists in the Linux kernel’s mt76 wireless driver for the mt7921 and mt7925 chipsets. Any Linux system running a kernel that includes these drivers is affected regardless of distribution, as long as the driver is loaded and the wireless interface is active. The patch introduces a NULL check in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(), so updating to a kernel that contains the patch commit resolves the issue.

Risk and Exploitability

The CVSS score of 5.5 places this vulnerability at medium severity, meaning the impact is significant but not catastrophic by itself. The EPSS score of less than 1% indicates a very low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker able to send a crafted CSA beacon to a target system that is actively using the affected wireless driver, which is typically a local or network‑adjacent threat. Consequently, the overall risk is moderate but the likelihood of real‑world exploitation is currently low.

Generated by OpenCVE AI on August 3, 2026 at 19:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a version that contains the mt76 driver patch commit 351dd7d2c80d23e56dcce6faa4e62bea5b0877c7 and reload the driver, or reboot the system to activate the updated code.
  • If an immediate kernel update is not possible, consider temporarily disabling or limiting wireless traffic that could trigger CSA beacons on the affected interface to reduce the attack surface until a patch is applied.
  • Regularly monitor vendor release notes or security advisories for updates to the mt76 driver and apply them promptly when available.

Generated by OpenCVE AI on August 3, 2026 at 19:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 26 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/20260502125824.425d7159@bongani-mini.home.org.za/ When a channel-switch announcement (CSA) beacon is received, cfg80211 queues a wiphy work item that eventually calls mt7921_channel_switch_rx_beacon(). If the station disconnects (or the channel context is otherwise torn down) between the time the work is queued and the time it runs, the driver's dev->new_ctx pointer can already have been cleared to NULL. mt7921_channel_switch_rx_beacon() then dereferences new_ctx unconditionally, triggering a NULL pointer dereference at address 0x0: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common] The same missing guard exists in mt7925_channel_switch_rx_beacon(), which shares the same code pattern introduced by the same commit. Add an early-return NULL check for dev->new_ctx in both mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). When new_ctx is NULL there is no pending channel switch to process, so returning immediately is the correct and safe action. Oops-Analysis: http://oops.fenrus.org/reports/lkml/20260502125824.425d7159@bongani-mini.home.org.za/report.html
Title wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-25T08:49:53.238Z

Reserved: 2026-07-19T15:36:31.780Z

Link: CVE-2026-64325

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:14.097

Modified: 2026-08-11T15:00:57.447

Link: CVE-2026-64325

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64325 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T19:15:04Z

Weaknesses