Executive brief
A vulnerability was identified in the Broadcom Wi-Fi driver (brcmfmac) within the Linux kernel. This issue occurs when the system attempts to stop a background monitoring task, potentially leading to a system crash or unpredictable behavior. While primarily affecting system stability, such flaws can sometimes be used by local attackers to disrupt operations or gain unauthorized access.
Technical details
A use-after-free (UAF) vulnerability exists in the brcmfmac driver, specifically within the SDIO bus implementation (`drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c`). The vulnerability is caused by a race condition where the watchdog task might terminate between the `send_sig()` and `kthread_stop()` calls. If the task exits prematurely, `kthread_stop()` attempts to access a task structure that has already been freed. The fix involves incrementing the task's reference count using `get_task_struct()` before signaling it and utilizing `kthread_stop_put()` to ensure the structure remains valid until the stop operation completes. This is a local vulnerability requiring the ability to trigger driver stop/remove sequences.
Affected products
- Linux Linux Kernel brcmfmac driver (SDIO)
Timeline
- 2026-04-16: patched: Initial patch authored by Marek Szyprowski.
- 2026-05-28: disclosed: CVE published in the NVD.
References
- https://git.kernel.org/stable/c/658d2e46c2e9a8eb9b80c5e803ce3c89885b3366
- https://git.kernel.org/stable/c/908b92231e1ded53e43fcfad5e0704d83e1b803c
- https://git.kernel.org/stable/c/c623b63580880cc742255eaed3d79804c1b91143
- https://git.kernel.org/stable/c/d16827cb1d3936f7627d0da6044483f743ebde03
- https://git.kernel.org/stable/c/ed4168d1a50fef5be8eca947fbbf05a28507d265