kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

🗓️ 04 Dec 2025 12:50:07Reported by RedHatType

redhat🔗 access.redhat.com👁 14 Views

Kernel fix for slab out-of-bounds read in brcmf_get_assoc_ies due to unchecked assoc_info lengths.

Reporter	Title	Published	Views	Family All 106
AstraLinux	Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15	14 Sep 202612:41	–	astralinux
BDU FSTEC	The vulnerability of the `brcmfmac/cfg80211.c` file within the `drivers/net/wireless/broadcom/brcm80211/brcmfmac` module of the Broadcom wireless driver for the Linux operating system allows a hacker to gain access to protected information or cause a service failure.	26 Feb 202600:00	–	bdu_fstec
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (ciqsa-2026_0010)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (ciqsa-2026_0635)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ciqsa-2026_0392)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.2 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_0619)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.2 [CIQ] Security Update: bpftool-debuginfo Multiple Vulnerabilities (ciqsa-2026_1248)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.2 [CIQ] Security Update: bpftool-debuginfo Multiple Vulnerabilities (ciqsa-2026_1249)	1 Oct 202600:00	–	nessus
Tenable Nessus	Photon OS 4.0: Linux PHSA-2021-4.0-0065	22 Jul 202100:00	–	nessus
Tenable Nessus	RHEL 9 : kernel (RHSA-2025:21051)	12 Nov 202500:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8.4	x86_64	bpftool	4.18.0-305.179.1.el8_4	bpftool-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	x86_64	bpftool-debuginfo	4.18.0-305.179.1.el8_4	bpftool-debuginfo-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	x86_64	kernel	4.18.0-305.179.1.el8_4	kernel-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	noarch	kernel-abi-stablelists	4.18.0-305.179.1.el8_4	kernel-abi-stablelists-4.18.0-305.179.1.el8_4.noarch.rpm
Red Hat Enterprise Linux	8.4	x86_64	kernel-core	4.18.0-305.179.1.el8_4	kernel-core-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	x86_64	kernel-debug	4.18.0-305.179.1.el8_4	kernel-debug-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	x86_64	kernel-debug-core	4.18.0-305.179.1.el8_4	kernel-debug-core-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	x86_64	kernel-debug-debuginfo	4.18.0-305.179.1.el8_4	kernel-debug-debuginfo-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	x86_64	kernel-debug-devel	4.18.0-305.179.1.el8_4	kernel-debug-devel-4.18.0-305.179.1.el8_4.x86_64.rpm
Red Hat Enterprise Linux	8.4	x86_64	kernel-debug-modules	4.18.0-305.179.1.el8_4	kernel-debug-modules-4.18.0-305.179.1.el8_4.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-53213
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lore	www.lore.kernel.org/linux-cve-announce/2025091511-CVE-2023-53213-dfc5@gregkh/T
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-53213
cve	www.cve.org/CVERecord

19 Aug 2026 21:05Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.1 - 8.1

EPSS0.00239

SSVC

kernel wifi brcmfmac association info memory safety usb device vulnerability syzkaller memory out of bounds