CVE-2026-90345 wifi: brcmfmac: fix P2P action frame handling without device vif

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

CVE-2026-90345

This vulnerability affects the brcmfmac Wi-Fi driver in the Linux kernel . Certain P2P action frame code paths incorrectly assume that the P2P device virtual interface (vif) is always present. This assumption breaks when userspace sends non-P2P public action frames through the primary interface, ...

EUVD-2026-82006

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

CVE-2026-90345 wifi: brcmfmac: fix P2P action frame handling without device vif

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. A remote attacker, by sending a specially crafted short authentication frame during the SAE Simultaneous Authentication of Equals authentication exchange, could trigger a heap overflow. This vulnerability allows for potential arbitrary...

PT-2026-94693

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the brcmfmac wifi driver regarding the handling of P2P action frames. Certain code paths incorrectly assume that the P2P device vif virtual interface is always...

CVE-2026-90345: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

SUSE CVE-2026-80949

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: brwimac: pcie: handling of randbuf allocation failure The kzalloc function in brwimacpciedownloadfwnvram will return null if physical memory runs out. As a result, if we use getrandombytes to generate random bytes into the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac: A NULL pointer dereference occurred in the brcmftxfinalize function. When the device is removed or the kernel module is unloaded, a potential NULL pointer dereference may occur. The following sequence leads to the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: brcmfmac: An error occurs when retrieving an invalid maxflowrings value from a dongle. When the firmware encounters a trap during initialization, the host reads an abnormal maxflowrings value from the dongle. This can lead to a...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac: A slab-out-of-bounds read occurred in brcmfgetassocies. This bug could occur when associnfo-reqlen, which is a value from a URB provided by a USB device, is larger than the size of the buffer, which is defined as...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: brcmfmac: pcie: Firmware is released in the brmfipciesetup error path. This prevents memory leaks if the brmfichipgetraminfo function fails. Note that the CLM blob is released in the device removal path...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fixed an issue where invalid address access occurred when enabling the SCAN log level. The variable i is changed when setting a random MAC address, causing invalid address access when printing the value of...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fixed a use-after-free bug in brcmfnetdevstartxmit ret = brcmfprototxqueuedatadrvr, ifp-ifidx, skb; may be scheduled, and then completed before the line ndev-stats.txbytes += skb-len; 46.912801...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: wifi: brcmfmac: Fixed a potential stack-out-of-bounds situation in brcmfcpreinitdcmds. This patch addresses a read operation that may lead to a stack-out-of-bounds condition, occurring when a buffer that is not null-terminated...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: brcmfmac: Ensure that the CLM version is terminated with null characters to prevent a stack-out-of-bounds issue. A stack-out-of-bounds read occurs in brcmfmac when a buffer that is not terminated with null characters is...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brwifimac – Fixed a potential memory leak in brwifinetdevstartxmit. The function brwifinetdevstartxmit returns NETDEVTXOK without freeing the skb variable, especially when pskbexpandhead fails. This issue was addressed by...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac: A potential out-of-bounds exception has been fixed in brcmfmac.brcmffwallocrequest. This patch addresses an out-of-bounds situation that occurs in brcmfmac when the chiprev provided by the device is too large. It...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac – Check the count value of the channel specification to prevent out-of-bounds reads This patch fixes out-of-bounds reads in brcmfconstructchaninfo and brcmfenablebw402g, which occur when the count value of the...