Junglewise Threat Intelligence

CVE-2025-21744: Linux Kernel brcmfmac NULL pointer dereference in brcmf_txfinalize

CVE-2025-21744 · Severity: medium · CVSS 5.5 · Published 2025-02-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Broadcom Wi-Fi driver could cause a system crash (kernel panic) when a Wi-Fi device is removed or its driver module is unloaded. This occurs due to a technical error where the system attempts to access memory that has already been cleared during the shutdown process. While this primarily affects system stability, it could be used to cause a denial-of-service on affected machines.

Technical details

A NULL pointer dereference exists in the brcmfmac driver within the brcmf_txfinalize() function. During device detachment or module unloading, the brcmf_del_if() function invalidates interface indices before the protocol layer is fully detached. If a flowring still contains socket buffers (skbs) during this sequence, the subsequent call to brcmf_txfinalize() receives a NULL interface pointer from brcmf_get_ifp(), leading to a crash when the driver attempts to update transmission statistics (ifp->ndev->stats.tx_errors). The fix introduces NULL pointer validation in brcmf_txfinalize() to safely drop packets and return early if the interface is already gone.

Affected products

  • Linux Linux Kernel 6.1.129, 6.6.78, 6.12.14, 6.13.3

Timeline

  • 2025-01-16: patched: Initial patch submitted by Marcel Hamer
  • 2025-02-27: advisory: CVE-2025-21744 published by kernel.org

References

Related threats