Based on the description, the Linux kernel’s brcmfmac driver has an uninitialized internal authentication status variable. When a network with an SSID shorter than 32 bytes or when a PMKID is supplied, this garbage can be copied to the device firmware, potentially revealing sensitive stack contents. The driver also forwards this uninitialized PMKID to the firmware, causing the firmware to cache garbage and then reject legitimate association attempts that include a PMKID. This behavior could lead to confidentiality leakage of internal kernel data and disrupt normal Wi‑Fi authentication, effectively denying service for subsequent connections.

All Linux kernel installations that include the brcmfmac (Broadcom) Wi‑Fi driver are potentially impacted. No specific kernel version range is provided, so the assumption is that any deployment using this driver could be vulnerable until a patch is applied.

Based on the description, it is inferred that the attack vector is local to the host system, requiring a role that can trigger Wi‑Fi authentication events to exercise the vulnerable path. The EPSS score of less than 1% indicates a very low likelihood of exploitation. The CVSS score of 7.0 indicates a medium severity. The vulnerability is not listed in CISA’s KEV catalog, and no publicly known remote exploit exists. The flaw could enable a local attacker to leak kernel data via the firmware and disrupt normal Wi‑Fi operations, justifying prompt remediation.