Junglewise Threat Intelligence

CVE-2025-39863: Linux Kernel brcmfmac use-after-free in Bluetooth coexistence detachment

CVE-2025-39863 · Severity: high · CVSS 7.8 · Published 2025-09-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's Broadcom Wi-Fi driver (brcmfmac) that could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs during the shutdown process of the Wi-Fi and Bluetooth coexistence component, where a timing conflict can lead to the system attempting to use memory that has already been cleared. This could impact system stability and the security of data handled by the wireless driver.

Technical details

A use-after-free vulnerability exists in the brcmfmac Wi-Fi driver within the brcmf_btcoex_detach() function. The root cause is a race condition where the btcoex timer handler (brcmf_btcoex_timerfunc) sets a 'timer_on' flag to false, causing the detachment routine to skip timer_shutdown_sync(). This allows the timer to potentially reschedule worker threads after the underlying brcmf_btcoex_info structure has been freed. An attacker with local access could exploit this race condition to trigger a use-after-free, leading to kernel memory corruption or a denial-of-service (system crash). The fix involves removing the conditional check and calling timer_shutdown_sync() unconditionally to ensure the timer is deactivated before memory is freed.

Affected products

  • Linux Linux Kernel 3.10 to 6.1.167, 6.6.x, 6.10.x, 6.11.x

Timeline

  • 2025-08-22: disclosed: Initial patch submitted by Duoming Zhou
  • 2025-09-09: patched: Patch committed to stable branches
  • 2025-09-19: advisory: CVE-2025-39863 published in NVD

References

Related threats