CVE-2026-64325: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64325 Overview

CVE-2026-64325 is a NULL pointer dereference vulnerability in the Linux kernel mt76 Wi-Fi driver, affecting the mt7921 and mt7925 chipset support code. The flaw resides in the channel-switch announcement (CSA) beacon handling path. When a CSA beacon is received, cfg80211 queues a wiphy work item that later invokes mt7921_channel_switch_rx_beacon() or mt7925_channel_switch_rx_beacon(). If the station disconnects or the channel context is torn down before the work runs, dev->new_ctx is cleared to NULL and the driver dereferences it unconditionally, triggering a kernel oops.

Critical Impact
An unauthenticated attacker within Wi-Fi range can transmit crafted CSA beacons that, combined with client disconnect timing, produce a kernel NULL pointer dereference and a denial-of-service condition on affected Linux systems using MediaTek MT7921 or MT7925 wireless chipsets.

Affected Products

Linux kernel mt76 driver — mt7921 common module (mt7921_common)
Linux kernel mt76 driver — mt7925 common module
Linux distributions shipping vulnerable versions of the mt76 driver stack

Discovery Timeline

2026-07-25 - CVE-2026-64325 published to the National Vulnerability Database
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64325

Vulnerability Analysis

The vulnerability is a classic NULL pointer dereference in a race-prone deferred-work path inside the MediaTek mt76 Wi-Fi driver. When the kernel processes an incoming CSA beacon, cfg80211 schedules a wiphy work item that eventually calls the driver's mt7921_channel_switch_rx_beacon() handler. That handler assumes dev->new_ctx points to a valid pending channel context.

The assumption breaks when the station disconnects, or the channel context is otherwise released, between the moment the work is queued and the moment it executes. In that window, dev->new_ctx is reset to NULL, and the handler dereferences it without a guard. The resulting fault surfaces as:

BUG: kernel NULL pointer dereference, address: 0000000000000000 at mt7921_channel_switch_rx_beacon+0x1f/0x100 [mt7921_common].

The identical defect exists in mt7925_channel_switch_rx_beacon(), which was introduced by the same commit and shares the code pattern.

Root Cause

The root cause is a missing NULL check on dev->new_ctx in the deferred CSA beacon handlers. The driver treats a pending channel switch as always present when the handler runs, ignoring the fact that lifecycle events on the station or channel context can invalidate that state asynchronously. This is a time-of-check to time-of-use style race between wiphy work execution and station teardown.

Attack Vector

Exploitation requires a Wi-Fi adjacent attacker capable of injecting or triggering CSA beacons that a vulnerable client processes. If the connection is torn down at the right instant relative to the queued work item, the driver dereferences NULL and the kernel oopses. The result is a denial-of-service on the affected host. There is no evidence in the advisory of memory corruption or code execution primitives beyond the kernel crash.

Refer to the upstream commits for the exact fix: 351dd7d2c80d and 77e7b127472a.

Detection Methods for CVE-2026-64325

Indicators of Compromise

Kernel oops messages containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP pointing to mt7921_channel_switch_rx_beacon or mt7925_channel_switch_rx_beacon.
Stack traces referencing the mt7921_common or mt7925_common modules in /var/log/kern.log, dmesg, or journalctl -k output.
Unexpected Wi-Fi interface resets or mt76-related module reloads correlated with CSA beacon activity on the local RF environment.

Detection Strategies

Monitor kernel logs on Linux endpoints using MediaTek MT7921/MT7925 hardware for the specific oops signature above.
Track kernel crash telemetry (kdump, systemd-coredump, ABRT) and alert on faults inside mt7921_common or mt7925_common.
Correlate wireless disconnect events with subsequent kernel faults to identify the race pattern.

Monitoring Recommendations

Forward dmesg and journald kernel-facility logs to a central log platform and build a rule for the mt76 NULL dereference signature.
Inventory endpoints using lspci -k or lsmod output to identify hosts loading the mt7921 or mt7925 drivers and prioritize patch tracking for them.
Watch for repeated CSA frames in wireless IDS feeds, which can indicate opportunistic triggering of the flaw.

How to Mitigate CVE-2026-64325

Immediate Actions Required

Update the Linux kernel to a stable release containing commits 351dd7d2c80d23e56dcce6faa4e62bea5b0877c7 and 77e7b127472a191e086e1e0b1b051703f33b1801.
On distributions that ship the mt76 driver out-of-tree (for example, via linux-firmware or backports packages), apply the vendor-provided package update once available.
Reboot after patching so the fixed mt7921_common and mt7925_common modules are loaded.

Patch Information

The upstream fix adds an early-return NULL check for dev->new_ctx in both mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). When new_ctx is NULL, no pending channel switch exists and the handler now returns immediately. The relevant stable-tree commits are 351dd7d2c80d and 77e7b127472a.

Workarounds

Disable or blacklist the mt7921e, mt7921u, mt7925e, or mt7925u modules on affected hosts if patching cannot be scheduled immediately and an alternate network path is available.
Avoid connecting affected devices to untrusted or high-density Wi-Fi environments where malicious or malformed CSA beacons are more likely.
Prefer wired network connectivity on mission-critical hosts using MT7921/MT7925 radios until the kernel update is deployed.

bash

# Temporarily unload and blacklist the vulnerable drivers until patched
sudo modprobe -r mt7921e mt7921u mt7925e mt7925u 2>/dev/null
echo -e "blacklist mt7921e\nblacklist mt7921u\nblacklist mt7925e\nblacklist mt7925u" | \
  sudo tee /etc/modprobe.d/disable-mt792x.conf
sudo update-initramfs -u