Executive brief
A vulnerability in the Linux kernel's Broadcom Wi-Fi driver could cause a system crash (kernel oops) when a Wi-Fi device fails to initialize, such as when firmware is missing. This issue affects systems using Broadcom SDIO-based wireless adapters. An exploit could lead to a denial-of-service condition, impacting system availability.
Technical details
A NULL pointer dereference (CWE-476) exists in the brcmfmac SDIO driver due to improper error handling during the device probe process. When brcmf_sdio_probe() fails (e.g., due to missing firmware), the sdiodev->bus pointer is incorrectly set to an error code instead of NULL. Subsequent cleanup routines in brcmf_sdio_remove() attempt to dereference this invalid pointer, resulting in a kernel oops. The fix ensures the bus pointer is correctly set to NULL on failure and modifies the probe function to return standard error codes. This is a local attack vector requiring the ability to trigger device probing or hardware initialization failures.
Affected products
- Linux Linux Kernel 6.13 to 6.18.16, 6.19 to 6.19.6, 7.0-rc1
Timeline
- 2026-02-03: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-13: advisory: NVD analysis completed