The vulnerability in the Linux kernel's mt76 driver for mt7921 and mt7925 WiFi devices arises from a missing NULL pointer check in the functions mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). When a channel-switch announcement beacon is received, a work item is queued to handle it. If the station disconnects or the channel context is torn down before the work runs, the dev->new_ctx pointer is cleared to NULL. The vulnerable functions dereference this pointer unconditionally, causing a kernel NULL pointer dereference and a BUG. The patch adds an early return if dev->new_ctx is NULL, preventing the crash.

Exploitation of this vulnerability results in a kernel NULL pointer dereference, causing a kernel crash (BUG) and potential denial of service on affected systems running the vulnerable WiFi driver. There is no indication of privilege escalation or code execution from the provided data.

A patch has been applied to the Linux kernel to add a NULL check for dev->new_ctx in the affected functions, preventing the NULL pointer dereference. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation. Patch status is not explicitly confirmed in the input; users should check the vendor or kernel mailing list advisories for the exact fixed versions and update accordingly.