CVE-2026-64325

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the mt76 WiFi driver when processing a channel-switch announcement (CSA) beacon. When cfg80211 queues a wiphy work item that calls the functions mt7921 channel switch rx beacon() or mt7925 channel switch rx beacon(), a race condition can occur if the station disconnects or the channel context is torn down before the work item executes. In such cases, the dev->new ctx pointer is cleared to NULL, but the functions dereference it unconditionally, leading to a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.