Executive brief
A vulnerability in the Broadcom Wi-Fi driver for the Linux kernel could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the driver processes specific wireless interface events without properly checking data provided by the hardware's firmware. This could lead to memory corruption, impacting the stability and security of devices using Broadcom wireless chipsets.
Technical details
An out-of-bounds array access vulnerability exists in the brcmfmac Wi-Fi driver within the Linux kernel. The function brcmf_fweh_handle_if_event() processes firmware-provided interface events but fails to perform a range check on the 'bsscfgidx' field before using it as an index for the 'drvr->iflist[]' array. An attacker within radio range (Adjacent vector) could potentially provide a malicious event that triggers an out-of-bounds read or write. This can result in a kernel panic (DoS) or potentially arbitrary code execution. The issue has been resolved by adding a check against BRCMF_MAX_IFS before indexing the array.
Affected products
- Linux Linux Kernel 3.9 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-04-07: patched: Initial patch commit 304950a467d83678bd0b0f46331882e2ac23b12d
References
- https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d
- https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734
- https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d
- https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6
- https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c
- https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e
- https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54