CVE-2026-64325 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the mt76 driver should assess their exposure and apply the provided patches. They should also verify patch application and system stability, and review compensating controls for exposed systems.

Why it matters

This vulnerability can cause a NULL pointer dereference in the Linux kernel's mt76 driver, leading to potential system crashes or instability. Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the mt76 driver should assess their exposure and apply the provided patches.

• Denial of Service (DoS) due to NULL pointer dereference
• Potential system crashes or instability
• Verification of patch application and system stability required

Technical summary

The vulnerability exists in the Linux kernel's mt76 driver, specifically in the mt7921 and mt7925 chipsets. A NULL pointer dereference occurs when a channel-switch announcement (CSA) beacon is received and the driver's dev->new_ctx pointer is cleared to NULL. This can happen when the station disconnects or the channel context is torn down between the time the work is queued and the time it runs. The fix adds an early-return NULL check for dev->new_ctx in both mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(), preventing the NULL pointer dereference.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor the Linux kernel's changelog for any related updates or patches.
• Verify patch application and system stability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported by Bongani Hlope and resolved by adding an early-return NULL check for dev->new_ctx in both mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). The fix ensures that the driver's dev->new_ctx pointer is not dereferenced when it is NULL, preventing a NULL pointer dereference vulnerability. Linux kernel maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the mt76 driver should verify patch application and system stability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.