CVE-2026-43110 - Vulnerability Details

- wifi: brcmfmac: validate bsscfg indices in IF events

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: validate bsscfg indices in IF events

brcmf_fweh_handle_if_event() validates the firmware-provided interface
index before it touches drvr->iflist[], but it still uses the raw
bsscfgidx field as an array index without a matching range check.

Reject IF events whose bsscfg index does not fit in drvr->iflist[]
before indexing the interface array.

[add missing wifi prefix]

Published: 2026-05-06

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The brcmfmac Wi‑Fi driver contains a bug where a firmware‑supplied interface index is checked before use, but the raw index is still employed as an array index without a bounds check. This omission allows a driver to write outside the intended array, corrupting kernel memory and potentially enabling privilege escalation or a system crash.

Affected Systems

All Linux kernel versions that include the brcmfmac module, specifically kernel releases 7.0 rc1 through rc7 as indicated by the CPE entries. Any system using these kernel configurations with the brcmfmac driver loaded is susceptible.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, yet the EPSS score of less than 1% suggests a low probability of real‑world exploitation at present. The vulnerability requires delivery of a specially crafted IF event, likely via a malicious wireless frame or manipulated firmware, to trigger the out‑of‑bounds write. It is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2880b86859967af710c72f7d34fb421a86a71e22`	affected	< 3ec7437e9d11374105c2c4e47ae671537729d7e6
`2880b86859967af710c72f7d34fb421a86a71e22`	affected	< 9fca68c2512a362cad258e4df12a307bb2ee4b8e
`2880b86859967af710c72f7d34fb421a86a71e22`	affected	< 1ae1e1caa428844e481231f6dbe9b4f475f1d52d
`2880b86859967af710c72f7d34fb421a86a71e22`	affected	< b427c2b05222db36d32ee141609de6128e9091bb
`2880b86859967af710c72f7d34fb421a86a71e22`	affected	< 304950a467d83678bd0b0f46331882e2ac23b12d

Linux

affected

Version	Status	Constraints
`3.9`	affected	—
`0`	unaffected	< 3.9
`6.6.136`	unaffected	≤ 6.6.*
`6.12.83`	unaffected	≤ 6.12.*
`6.18.24`	unaffected	≤ 6.18.*
`6.19.14`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3ec7437e9d11374105c2c4e47ae671537729d7e6)`	affected	code_commit	—
`[1da177e4c3f41524e886b8a0c1fc7321cac2,9fca68c2512a362cad258e4df12a307bb2ee4b8e)`	affected	code_commit	—
`[1da177e4c3f41524e886b8a0c1fc7321cac2,1ae1e1caa428844e481231f6dbe9b4f475f1d52d)`	affected	code_commit	—
`[1da177e4c3f41524e886b8a0c1fc7321cac2,b427c2b05222db36d32ee141609de6128e9091bb)`	affected	code_commit	—
`[1da177e4c3f41524e886b8a0c1fc7321cac2,304950a467d83678bd0b0f46331882e2ac23b12d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.136,6.7.0)`	unaffected	semver	—
`[6.12.83,6.13.0)`	unaffected	semver	—
`[6.18.24,6.19.0)`	unaffected	semver	—
`[6.19.14,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the patched brcmfmac driver, which adds proper bounds checking for bsscfg indices.
If Wi‑Fi functionality is not required, unload or blacklist the brcmfmac module to eliminate the attack surface.
Keep abreast of kernel changelogs for additional fixes or regressions related to the Wi‑Fi driver.

Generated by OpenCVE AI on May 8, 2026 at 22:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d
https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d
https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6
https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e
https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb
https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43110-7309@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43110
https://www.cve.org/CVERecord?id=CVE-2026-43110

History

Fri, 08 May 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Fri, 08 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 07 May 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-787 CWE-788

Thu, 07 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1285
References		https://lore.kernel.org/linux-cve-announce/2026050624-CVE-2026-43110-7309@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43110 https://www.cve.org/CVERecord?id=CVE-2026-43110
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Wed, 06 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787 CWE-788

Wed, 06 May 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. [add missing wifi prefix]
Title		wifi: brcmfmac: validate bsscfg indices in IF events
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6 https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-06T07:40:37.250Z

Updated: 2026-05-11T22:17:55.761Z

Reserved: 2026-05-01T14:12:55.986Z

Link: CVE-2026-43110

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-06T10:16:24.690

Modified: 2026-05-08T20:14:50.097

Link: CVE-2026-43110

Redhat

Severity : Important

Publid Date: 2026-05-06T00:00:00Z

Links: CVE-2026-43110 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-08T22:30:18Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object