Executive brief
A vulnerability in the Linux kernel's Broadcom Wi-Fi driver could cause a system crash (kernel panic) when a Wi-Fi device is removed or its driver module is unloaded. This occurs due to a technical error where the system attempts to access memory that has already been cleared during the shutdown process. While this primarily affects system stability, it could be used to cause a denial-of-service on affected machines.
Technical details
A NULL pointer dereference exists in the brcmfmac driver within the brcmf_txfinalize() function. During device detachment or module unloading, the brcmf_del_if() function invalidates interface indices before the protocol layer is fully detached. If a flowring still contains socket buffers (skbs) during this sequence, the subsequent call to brcmf_txfinalize() receives a NULL interface pointer from brcmf_get_ifp(), leading to a crash when the driver attempts to update transmission statistics (ifp->ndev->stats.tx_errors). The fix introduces NULL pointer validation in brcmf_txfinalize() to safely drop packets and return early if the interface is already gone.
Affected products
- Linux Linux Kernel 6.1.129, 6.6.78, 6.12.14, 6.13.3
Timeline
- 2025-01-16: patched: Initial patch submitted by Marcel Hamer
- 2025-02-27: advisory: CVE-2025-21744 published by kernel.org
References
- https://git.kernel.org/stable/c/2326e19190e176fd72bb542b837a9d2b7fcb8693
- https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d
- https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b
- https://git.kernel.org/stable/c/59ff4fa653ff6db07c61152516ffba79c2a74bda
- https://git.kernel.org/stable/c/61541d9b5a23df33934fcc620a3a81f246b1b240
- https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb
- https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9