CVE-2026-99061 - Vulnerability Details

- wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

When the driver is removed while the user space process that created
the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device
interface is removed twice and the kernel crashes.

The two paths are:

- wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P
device. nl80211_del_interface() holds RTNL and the wiphy mutex and
calls brcmf_p2p_del_vif(), which disables discovery and waits up to
1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),
which unregisters the wdev and frees the vif and the ifp.

- brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,
and calls brcmf_remove_interface(ifp, false) for the same ifp.
brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on
rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls
cfg80211_unregister_wdev() on the wdev that was already unregistered
and freed.

The second list_del_rcu() of wdev->list faults on LIST_POISON2:

brcmfmac: brcmf_p2p_del_vif delete P2P vif
brcmfmac: brcmf_p2p_deinit_discovery enter
brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared
brcmfmac: brcmf_detach Enter
brcmfmac: brcmf_bus_change_state 1 -> 0
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed
[1.5 s later, brcmf_p2p_del_vif() timed out]
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed
Unable to handle kernel paging request at virtual address dead000000000122
Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP
pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]
Call trace:
_cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]
cfg80211_unregister_wdev+0x10/0x1c [cfg80211]
brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]
brcmf_remove_interface+0x1f4/0x254 [brcmfmac]
brcmf_detach+0x88/0x180 [brcmfmac]
brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]
brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]
brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]
sdio_bus_remove+0x38/0x144
device_release_driver_internal+0x1e8/0x2c0
device_release_driver+0x14/0x20
brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]
brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]
__exit_compat+0x18/0x418 [brcmfmac_cyw]
__arm64_sys_delete_module+0x1ac/0x244

The log was taken with debug=0x406 on an i.MX 8M Plus board with a
CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of
brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same
in mainline.

To reproduce:

1. Start wpa_supplicant on wlan0 and let it associate. It creates the
P2P device (iw dev shows "type P2P-device").
2. Stop wpa_supplicant and remove the driver without waiting for
wpa_supplicant to exit:

kill $(pidof wpa_supplicant)
rmmod brcmfmac_cyw brcmfmac

The crash is reproducible on that board.

For the interface without a netdev (the P2P device), take RTNL and the
wiphy mutex in brcmf_detach() before reading iflist, and remove it with
locked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the
slot empty. If brcmf_detach() runs first, nl80211 does not find the wdev
any more. The interfaces with a netdev are removed as before, because
brcmf_del_if() takes RTNL on its own for the primary interface.

Published: 2026-10-23

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The issue is a race condition in the Linux kernel brcmfmac driver, triggered when a P2P device is removed from user space while the driver itself is being detached. The driver attempts to unregister the same wireless device twice, leading to a double free and a kernel crash. This results in a system reboot or loss of network functionality but does not enable arbitrary code execution by an attacker.

Affected Systems

The vulnerability affects any Linux system that uses the brcmfmac wireless driver, including mainstream distributions that ship the default kernel. It was demonstrated on an i.MX 8M Plus board running a CD Linux kernel 5.4-rt with a CYW55513 Wireless module, but the code path is present in all versions of brcmfmac where the race is not yet patched.

Risk and Exploitability

No EPSS or KEV data is available, so the exploit probability is unknown. However, the flaw can be triggered by controlling the sequence of wpa_supplicant termination and driver removal. An attacker who can execute commands on the host could cause a crash, producing a denial‑of‑service condition. The CVSS score is not publicly listed, so the exact severity requires local assessment, but the impact is significant if the system is critical.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9831bcb987df4aff6a1d85975f1dda4c654f298d`	affected	< 7b79131e357c4786765b20a994ad40d4d35f2163
`9831bcb987df4aff6a1d85975f1dda4c654f298d`	affected	< 2e0c8c60a11b3177e7432c71d41249e276a0825f
`9831bcb987df4aff6a1d85975f1dda4c654f298d`	affected	< eef16a74ff8ed2a838d6bb862bb2c7783fce7466
`9831bcb987df4aff6a1d85975f1dda4c654f298d`	affected	< 47ca6395a1d91545cc9403f9218bc61be941a0c3
`9831bcb987df4aff6a1d85975f1dda4c654f298d`	affected	< 08a3f02fea636e97a7422d1512f76dacdb5b0887

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version where the brcmfmac race condition has been fixed, such as Linux kernel 6.19 or later.
Prior to unloading brcmfmac, ensure wpa_supplicant has fully exited; for example, stop the process and wait for any child processes to terminate before running rmmod.
If updating is not immediately possible, disable P2P device creation in wpa_supplicant by setting "p2p_disabled=1" or by removing P2P configuration options to prevent the race from occurring.

Generated by OpenCVE AI on October 23, 2026 at 15:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/08a3f02fea636e97a7422d1512f76dacdb5b0887
https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f
https://git.kernel.org/stable/c/47ca6395a1d91545cc9403f9218bc61be941a0c3
https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163
https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466

History

Fri, 23 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-703

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device interface is removed twice and the kernel crashes. The two paths are: - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P device. nl80211_del_interface() holds RTNL and the wiphy mutex and calls brcmf_p2p_del_vif(), which disables discovery and waits up to 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(), which unregisters the wdev and frees the vif and the ifp. - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives, and calls brcmf_remove_interface(ifp, false) for the same ifp. brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls cfg80211_unregister_wdev() on the wdev that was already unregistered and freed. The second list_del_rcu() of wdev->list faults on LIST_POISON2: brcmfmac: brcmf_p2p_del_vif delete P2P vif brcmfmac: brcmf_p2p_deinit_discovery enter brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared brcmfmac: brcmf_detach Enter brcmfmac: brcmf_bus_change_state 1 -> 0 brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed [1.5 s later, brcmf_p2p_del_vif() timed out] brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed Unable to handle kernel paging request at virtual address dead000000000122 Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] Call trace: _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211] cfg80211_unregister_wdev+0x10/0x1c [cfg80211] brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac] brcmf_remove_interface+0x1f4/0x254 [brcmfmac] brcmf_detach+0x88/0x180 [brcmfmac] brcmf_sdio_remove+0x90/0x7b0 [brcmfmac] brcmf_sdiod_remove+0x20/0xa0 [brcmfmac] brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac] sdio_bus_remove+0x38/0x144 device_release_driver_internal+0x1e8/0x2c0 device_release_driver+0x14/0x20 brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac] brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac] __exit_compat+0x18/0x418 [brcmfmac_cyw] __arm64_sys_delete_module+0x1ac/0x244 The log was taken with debug=0x406 on an i.MX 8M Plus board with a CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same in mainline. To reproduce: 1. Start wpa_supplicant on wlan0 and let it associate. It creates the P2P device (iw dev shows "type P2P-device"). 2. Stop wpa_supplicant and remove the driver without waiting for wpa_supplicant to exit: kill $(pidof wpa_supplicant) rmmod brcmfmac_cyw brcmfmac The crash is reproducible on that board. For the interface without a netdev (the P2P device), take RTNL and the wiphy mutex in brcmf_detach() before reading iflist, and remove it with locked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the slot empty. If brcmf_detach() runs first, nl80211 does not find the wdev any more. The interfaces with a netdev are removed as before, because brcmf_del_if() takes RTNL on its own for the primary interface.
Title		wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/08a3f02fea636e97a7422d1512f76dacdb5b0887 https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f https://git.kernel.org/stable/c/47ca6395a1d91545cc9403f9218bc61be941a0c3 https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163 https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:22:59.770Z

Updated: 2026-10-23T12:22:59.770Z

Reserved: 2026-09-25T10:25:14.388Z

Link: CVE-2026-99061

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:29.873

Modified: 2026-10-23T13:17:29.873

Link: CVE-2026-99061

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-23T15:45:16Z

Weaknesses

CWE-416
Use After Free
CWE-703
Improper Check or Handling of Exceptional Conditions

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object