Executive brief
A vulnerability was identified in the Linux kernel's Broadcom Wi-Fi driver (brcmfmac) where the system failed to properly validate internal hardware core initialization. This could lead to a system crash or unpredictable behavior when the Wi-Fi hardware encounters specific initialization errors. This affects the stability of devices using Broadcom wireless chipsets.
Technical details
An error pointer dereference vulnerability exists in the brcmfmac driver within the Linux kernel. The function 'brcmf_chip_recognition()' calls 'brcmf_chip_add_core()', which can return an error pointer (ERR_PTR) instead of a valid memory address. The driver previously failed to check these return values before passing them to 'brcmf_chip_sb_corerev()', leading to a potential null or invalid pointer dereference. This issue was identified by the Smatch static analysis tool. A fix has been implemented by adding IS_ERR() checks and returning the appropriate error code if core addition fails.
Affected products
- Linux Linux cb7cf7be9eba7 to dd8592fc6007a451c3e4b9025de365e39de8178a
Timeline
- 2026-02-16: other: Patch authored
- 2026-05-23: patched: Patch committed to stable trees
- 2026-06-24: advisory: CVE published
References
- https://git.kernel.org/stable/c/2e0e5a43ed126f896a4ad31ade66c90270601bae
- https://git.kernel.org/stable/c/334c68750eee84c2327db1d152be83ff5ad8e20b
- https://git.kernel.org/stable/c/99ef547659178eef6d6ba4738a9d989ce90cf909
- https://git.kernel.org/stable/c/a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af
- https://git.kernel.org/stable/c/bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d
- https://git.kernel.org/stable/c/cbea71b4480394708f9a6e007a0385acfe5e1ec8
- https://git.kernel.org/stable/c/d3f280be48f1c672cb10e8026c236d0cca60048a