The vulnerability arises from the brcmfmac wireless driver’s function brcmf_chip_add_core() returning an error pointer without proper checking. The unchecked error pointer can be dereferenced, causing a kernel crash and a denial of service. While the description does not state that arbitrary code execution is possible, a kernel panic could allow a local attacker to interrupt services or execute privileged code after reboot.

Affected systems are Linux kernels that include the Broadcom brcmfmac driver, such as the default distributions that ship with the driver. Version information for the affected kernels is not specified in the CVE data, so any kernel that contains the legacy brcmfmac code without the applied fix is potentially impacted.

The CVS score is not provided, and the EPSS score is unavailable, but the lack of a severity rating does not negate the risk of a kernel crash. The vulnerability appears to be exploitable by an attacker who can trigger the wireless driver—likely through crafted packets or by manipulating the Wi-Fi hardware interface. The impact is limited to local or remote attackers who can interact with the wireless device; no remote code execution is documented. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, the failure to handle error pointers is a high‑consequence bug typical of a low‑impact CVE score of 5–7, but the actual severity depends on the environment and the attacker's ability to interact with the driver.