During the probe of an SDIO brcmfmac Wi‑Fi device, the driver mistakenly assigns the bus pointer twice—once during the main probe and again during the SDIO probe. When the probe fails, this causes the driver to set the pointer to an invalid error value instead of NULL, and later the removal routine attempts to free resources through this corrupt pointer, triggering a kernel oops. The result is a local kernel crash that disrupts system availability and could be exploited to cause a denial‑of‑service state for the user or system.

All Linux kernel installations containing the brcmfmac driver are affected, regardless of distribution, until the patched code is incorporated. The bug exists in any kernel revision prior to the fix, which is relevant to devices with internal Wi‑Fi adapters using the SDIO interface.

The CVSS score is 5.5, and the EPSS score is 0.00022. The bug is not listed in the CISA KEV catalog. Because an attacker would need to trigger the SDIO probe failure—most likely by causing the system to lack the required firmware or by interacting with a removable Wi‑Fi adapter—the risk is constrained to local exploitation. Successful exploitation results in a kernel oops and consequent reboot or loss of service for the affected device, with no confirmed privilege escalation or data compromise reported.