[BUG] Potential Null Pointer Dereference in ieee80211_chsw_switch_vifs Function
From: 冯嘉仪 <hidden>
Date: 2026-02-14 13:00:33
Also in:
linux-wireless, lkml
Dear Maintainer, Our team recently developed a null-pointer-dereference (NPD) vulnerability detection tool, and we used it to scan the Linux Kernel (version 6.9.6). After manual review, we identified a potentially vulnerable code snippet that could lead to a null-pointer dereference bug. We would appreciate your expert insight to confirm whether this vulnerability could indeed pose a risk to the system. Vulnerability Description: File: net/mac80211/chan.c In the function ieee80211_chsw_switch_vifs, we found the following line of code: vif_chsw[i].old_ctx = &old_ctx->conf; The issue arises because the old_ctx pointer may be passed as NULL in certain situations. Since old_ctx is NULL, accessing &old_ctx->conf in the statement could result in a null-pointer dereference. Proposed Fix: To prevent the potential null-pointer dereference, we suggest adding a NULL check for the old_ctx pointer before attempting to dereference &old_ctx->conf in the line. Request for Review: We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system, and if the proposed fix is appropriate. If there are reasons why this issue does not present a real risk (e.g., the NULL check is redundant or unnecessary), we would be grateful for clarification. Thank you for your time and consideration.