The brcmsmac Wi‑Fi driver in the Linux kernel allocates DMA memory with dma_alloc_consistent(), which may round the requested size up to an alignment boundary. The original, smaller size is retained in the alloced field and used by dma_free_coherent() to free the memory. When the free size does not match the actual allocated size, the free operation can corrupt kernel memory, potentially destabilizing the system or exposing security flaws. The weakness is identified as a memory corruption issue (CWE‑763).

Affected versions include the Linux kernel 3.2 and the 7.0 release candidates (rc1‑rc7), as listed in the CPE data. The flaw is present in any kernel configuration that builds the brcmsmac driver. Consequently, systems running any of these kernel releases with the brcmsmac driver enabled are subject to the vulnerability.

The CVSS score of 5.5 denotes a moderate severity, while the EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the driver context, the attack likely requires local access or interaction with the Wi‑Fi hardware; no remote exploitation vector is described in the CVE data. The mismatch in allocation and free sizes could lead to kernel crashes or other stability issues, but the description does not explicitly state escalation or denial of service outcomes, so any such impact is inferred but not confirmed by the official data.