A race condition in the Linux kernel’s brcmfmac wireless driver causes the driver to attempt to unregister the same P2P device twice when a user‑space process that created the device (such as wpa_supplicant) exits and the driver is detached at the same time. This double unregistration leads to a use‑after‑free and the kernel crashes. The crash results in loss of network functionality and often a system reboot, thereby denying service.

Any Linux installation that includes the brcmfmac driver on devices that create P2P devices is affected. The vulnerability was demonstrated on an i.MX 8M Plus board with a CYW55513 module running a 5.4‑rt kernel and the Ezurio backport of brcmfmac v6.18.22, but the same code path exists in mainline kernels and any backports that have not yet applied the listed fix.

The EPSS score of < 1 % indicates a very low likelihood that attackers will successfully exploit the race condition in the wild, and the vulnerability is not listed in the CISA KEV catalogue. The CVSS score of 4.1 classifies it as moderate severity. Based on the description, it is inferred that an attacker with local privileges who can control the order of wpa_supplicant termination and driver unloading can trigger the crash, resulting in a denial‑of‑service. No evidence of remote code execution or privilege escalation is mentioned in the advisory.