[BUG] Potential Null Pointer Dereference in ieee80211_rx_mgmt_beacon Function

From: 冯嘉仪 <hidden>
Date: 2026-02-14 13:05:34
Also in: linux-wireless, lkml

Dear Maintainer,

Our team recently developed a null-pointer-dereference (NPD) vulnerability detection tool, and we used it to scan the Linux Kernel (version 6.9.6). After manual review, we identified a potentially vulnerable code snippet that could lead to a null-pointer dereference bug. We would appreciate your expert insight to confirm whether this vulnerability could indeed pose a risk to the system.

Vulnerability Description:
File:  net/mac80211/mlme.c
In the function ieee80211_rx_mgmt_beacon, we found the following line of code:

ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {

The issue arises because the bssid pointer may be passed as NULL in certain situations. The statement passes the bssid pointer to ieee80211_rx_our_beacon without any check, but ieee80211_rx_our_beacon might contain a dereference operation on the bssid pointer, which could result in a null-pointer dereference.

Proposed Fix:
To prevent the potential null-pointer dereference, we suggest adding a NULL check for the bssid pointer before attempting to pass the pointer to ieee80211_rx_our_beacon.

Request for Review:
We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system, and if the proposed fix is appropriate. If there are reasons why this issue does not present a real risk (e.g., the NULL check is redundant or unnecessary), we would be grateful for clarification.

Thank you for your time and consideration.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help