Executive brief
The Linux kernel's Broadcom WiFi driver (brcmfmac) contains a defect in P2P (peer-to-peer) action frame handling that can cause system crashes or instability when certain WiFi management frames are processed. The vulnerability arises when the driver assumes a P2P virtual interface is always available, but userspace applications may send public action frames or abort operations before the interface is created, leading to null pointer dereferencing and potential denial of service.
Technical details
The vulnerability is a null pointer dereference in the brcmfmac driver's P2P action frame code (p2p.c). Specifically, functions `brcmf_p2p_abort_action_frame()` and `brcmf_p2p_send_action_frame()` assume the P2P device virtual interface (vif) is always present, but this assumption fails when userspace sends non-P2P public action frames through the primary interface or when action-frame abort runs before the P2P device vif is created. The fix adds two guards: (1) falling back to the primary vif when aborting an action frame if the P2P device vif does not exist, and (2) checking that the P2P device vif exists before accessing its saved IE data during peer channel search. No authentication or special privileges are required—any local WiFi operation can trigger the condition. The patch is available and has been merged into the Linux kernel stable tree.
Affected products
- Linux Linux Kernel Affected versions prior to fix commit 1b1edb9ebed49099bdc924cef49a9aea8b552199 (merged 2026-08-02); impacts brcmfmac driver in kernel 4.14 and later versions
Timeline
- 2026-09-17: disclosed: CVE-2026-90345 published on NVD
- 2026-08-02: patched: Fix merged into Linux kernel mainline (commit 1b1edb9ebed49099bdc924cef49a9aea8b552199)
- 2026-09-14: patched: Fix backported to stable kernel (commit f26e1b16904555e171292e183c3cfc1c38159fc5)