A vulnerability in the Linux kernel’s brcmfmac wireless driver allows a crafted Wi‑Fi authentication frame to trigger a heap overflow. During the SAE authentication exchange, the driver computes the frame length from data received from the firmware and performs a memcpy without properly bounding the length, resulting in a wraparound when the frame is shorter than the management header. The overflow can overwrite kernel heap memory, giving an attacker the potential to execute arbitrary code on the device. The flaw is consequent of a lack of bounds checking and the unsigned wraparound behavior in the length calculation.

All systems that run a Linux kernel with the brcmfmac driver and the cyw component are potentially impacted. The issue exists in any kernel version prior to the commit that implements the overflow guard, as referenced in the advisory. The fix is present in kernels that have incorporated commit 185bb156c427d0f865d344a6d0eaa02c6d05cc57 or later. Consequently, any distribution that includes these older kernel versions and uses the brcmfmac driver is at risk.

The vulnerability can be leveraged remotely over a wireless connection; the analysis infers that an attacker who can send forged authentication frames to a target device—such as by operating a malicious or malfunctioning access point—can exploit this flaw. The CVSS score of 8.8 indicates a high severity impact, while the EPSS score of <1% suggests the probability of exploitation is currently low but not zero. The flaw is not listed in the CISA KEV catalog, and no public exploits have been reported, but the nature of the vulnerability allows an attacker to potentially take control of the kernel if successful.