CVE-2024-27048

What it actually does

Null pointer dereference in brcmf_pmksa_v3_op() when kzalloc() for pmk_op returns NULL under memory exhaustion, with no error check before dereference.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using Broadcom 802.11 drivers, causing unplanned downtime, lost work, and operational disruption until reboot or patch.

How an attack unfolds

An attacker triggers the vulnerable path in low-memory conditions to force kzalloc failure, resulting in a null dereference crash; no public exploits or threat actor campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit df62e22c2e27420e8990a4f09e30d7bf56c2036f which adds the -ENOMEM return on kzalloc failure.

How to confirm the fix worked

Verify kernel source contains the error-handling change in brcmf_pmksa_v3_op() or confirm running kernel includes the referenced commit.

Typical attack path

1. Exhaust system memory to force allocation failure
2. Invoke brcmf_pmksa_v3_op() via WiFi PMKSA operations
3. Trigger NULL dereference and kernel panic

How to detect it

Search kernel logs and dmesg for null pointer dereference oops mentioning brcmf_pmksa_v3_op or pmk_op allocation failure.

• brcmf_pmksa_v3_op
• kzalloc.*pmk_op
• NULL pointer dereference.*brcmf

What your security team should do

• Apply the fixed kernel commit across all affected distributions immediately
• Monitor kernel logs for brcmf-related oops and null dereference panics
• Test WiFi functionality under memory pressure after patching