[BUG] Potential Null Pointer Dereference in ieee80211_chsw_switch_vifs Function

From: 冯嘉仪 <hidden>
Date: 2026-02-14 13:00:33
Also in: linux-wireless, lkml

Dear Maintainer,

Our team recently developed a null-pointer-dereference (NPD) vulnerability detection tool, and we used it to scan the Linux Kernel (version 6.9.6). After manual review, we identified a potentially vulnerable code snippet that could lead to a null-pointer dereference bug. We would appreciate your expert insight to confirm whether this vulnerability could indeed pose a risk to the system.

Vulnerability Description:
File:  net/mac80211/chan.c
In the function ieee80211_chsw_switch_vifs, we found the following line of code:

vif_chsw[i].old_ctx = &old_ctx->conf;

The issue arises because the old_ctx pointer may be passed as NULL in certain situations. Since old_ctx is NULL, accessing &old_ctx->conf in the statement could result in a null-pointer dereference.

Proposed Fix:
To prevent the potential null-pointer dereference, we suggest adding a NULL check for the old_ctx pointer before attempting to dereference &old_ctx->conf in the line.

Request for Review:
We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system, and if the proposed fix is appropriate. If there are reasons why this issue does not present a real risk (e.g., the NULL check is redundant or unnecessary), we would be grateful for clarification.

Thank you for your time and consideration.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help