CVE-2026-53093: Linux brcmfmac WiFi Driver Kernel Panic Vulnerability

Technical summary

The vulnerability exists in drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c within the brcmf_chip_recognition() function. The brcmf_chip_add_core() function returns either a valid pointer or an error pointer (via ERR_PTR macro), but the caller does not validate the return value before dereferencing it at lines 1010, 1013, 1016, 1019, and 1022. This is a null/error pointer dereference vulnerability (CWE-476) that can be triggered during chip recognition, typically at driver load or device enumeration time. The flaw was detected using static analysis by Smatch.

Business impact

Systems relying on Broadcom WiFi hardware (common in laptops, IoT devices, and wireless access points) may become unavailable if the driver crashes. While the vulnerability requires local access and does not compromise confidentiality or integrity, repeated crashes can disrupt operations, increase support costs, and affect user productivity. Organizations with fleets of affected devices should prioritize patching to maintain service continuity.

Affected systems

Linux kernel deployments that include the brcmfmac driver for Broadcom 802.11 WiFi chipsets. This includes many consumer laptops, some embedded systems, and network infrastructure. The vulnerability affects the Linux kernel itself; affected end products depend on which kernel version and Broadcom chipsets a vendor ships. Check your device manufacturer's advisories for specific product impact.

Exploitability

Exploitation requires local access (AV:L) with low privilege (PR:L) and no user interaction. Any unprivileged local user can trigger the crash by loading or interacting with the WiFi driver during system boot or device hotplug. The attack is straightforward and reliable, making it a practical denial-of-service vector for anyone with shell access.

Remediation

Apply a Linux kernel update that includes the fix to brcmf_chip_recognition(). The patch adds proper error pointer checks before dereferencing the result of brcmf_chip_add_core(). Verify the patched kernel version against your vendor (e.g., your Linux distribution or device manufacturer). In the interim, restrict local shell access if feasible, though this is not a complete mitigation.

Patch guidance

Obtain and deploy a patched Linux kernel from your distribution or device manufacturer. The fix is upstream in the Linux kernel; major distributions (Red Hat, Debian, Ubuntu, SUSE, etc.) will backport it to their supported kernel branches. For embedded systems or custom kernels, apply the upstream patch directly. Verify the patch resolves the Smatch warnings in chip.c at the identified line numbers.

Detection guidance

Monitor kernel logs for oops, panic, or segmentation fault messages referencing brcmfmac driver code, particularly in brcmf_chip_recognition(). System uptime drops or WiFi driver reload events without user action may signal exploitation. Use static analysis tools (Smatch, Coverity) on your kernel source to identify the unpatched code pattern. On running systems, check dmesg for any brcmfmac-related errors during initialization.

Why prioritize this

This is a moderate-severity local denial-of-service vulnerability affecting a widely-used driver component. The CVSS score of 5.5 reflects high availability impact but requires local access. Prioritize patching for systems where WiFi stability is critical (laptops, mobile hotspots, IoT gateways) and where untrusted users may have shell access. In air-gapped or single-user environments, risk is lower.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) is derived from: local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact (I:N), but high availability impact (A:H). The score reflects that while the crash is easy to trigger and has serious availability consequences, it requires a local account and does not leak data or enable privilege escalation.

Frequently asked questions