CVE-2026-46180: Linux brcmfmac Watchdog Use-After-Free Local Privilege Escalation

Technical summary

CVE-2026-46180 is a use-after-free (CWE-416) flaw in the brcmfmac Wi-Fi driver's watchdog thread termination sequence. The vulnerability arises from insufficient reference counting when signaling and stopping the watchdog task. Specifically, send_sig() is called without holding a reference to the watchdog task, creating a window where the task can be freed before kthread_stop() executes. The fix involves incrementing the task reference count before send_sig() and using kthread_stop_put() to atomically decrement the reference and halt the thread, eliminating the race condition.

Business impact

Systems relying on Broadcom Wi-Fi adapters with the vulnerable brcmfmac driver face kernel stability risks and potential privilege escalation. Compromised systems could experience unplanned downtime from kernel crashes or unauthorized code execution. For organizations with Linux-based network infrastructure, edge devices, or embedded systems using affected Wi-Fi hardware, this vulnerability warrants prioritized patching to maintain operational continuity and security posture.

Affected systems

The Linux kernel is affected across versions prior to the fix. Any system running a vulnerable kernel build with the brcmfmac driver compiled in or loaded as a module is at risk. This includes servers, desktops, laptops, and embedded systems using Broadcom Wi-Fi hardware (such as BCM4356, BCM4358, or other brcmfmac-supported chipsets). Verify your kernel version and driver configuration against the Linux project's official advisory.

Exploitability

Exploitation requires local system access and the ability to trigger watchdog task shutdown conditions, typically through power management events or explicit driver unload sequences. The vulnerability is not remotely exploitable without first obtaining local privileges. However, the race condition window is reliable enough that repeated attempts are likely to succeed, making this a practical attack vector for local privilege escalation scenarios.

Remediation

Apply kernel updates containing the watchdog task reference counting fix. Verify the applied kernel version against the Linux kernel stable release notes or your distribution's security advisory. As an interim measure, systems without immediate patching capability should restrict local user access and disable Wi-Fi driver unloading where operationally feasible.

Patch guidance

Consult your Linux distribution's security advisories and kernel release notes for specific patched versions. Major distributions (Red Hat, Debian, Ubuntu, SUSE, etc.) typically release kernel security updates through their standard patch channels. Verify the fix commit resolves the brcmfmac watchdog reference counting issue before deploying. Test kernel updates in a non-production environment to confirm Wi-Fi driver stability post-patch.

Detection guidance

Monitor kernel logs for watchdog-related errors, use-after-free warnings, or brcmfmac driver crashes following power state transitions or driver reload events. Use kernel debugging tools (e.g., kasan if enabled) to detect memory access violations. Endpoint detection and response (EDR) solutions should flag unexpected kernel crashes correlated with Wi-Fi device events. Review kernel version and driver compilation state across your fleet to identify affected systems.

Why prioritize this

This vulnerability merits high priority due to its CVSS 7.8 (HIGH) score reflecting local privilege escalation potential, direct impact on kernel stability, and widespread presence in Linux distributions. The fix is straightforward and available, reducing remediation friction. Prioritize systems with untrusted local users, shared compute resources, or edge deployments relying on Broadcom Wi-Fi hardware.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a high-severity local attack requiring user-level privileges but no user interaction. The attack vector is local, attack complexity is low, and the impact spans confidentiality, integrity, and availability—enabling both crash and privilege escalation scenarios. This score appropriately captures the practical risk to multi-user systems and containerized environments where kernel exploitation directly undermines isolation.

Frequently asked questions