CVE-2024-35811

What it actually does

Use-after-free in the brcmfmac WiFi driver occurs when brcmf_cfg80211_detach frees the cfg structure while the escan_timeout_work timer/worker may still execute and reference it.

Why it matters to the business

Systems using affected Broadcom USB WiFi hardware can experience kernel crashes or instability during hotplug disconnects, leading to downtime and potential data loss on Linux servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access triggers USB device removal via hotplug while the escan timeout worker is scheduled, causing the worker to dereference the already-freed cfg object and resulting in a crash or potential code execution.

How to fix it

Update the Linux kernel to a version containing commit 202c503935042272e2f9e1bb549d5f69a8681169 or later; apply the patch that deletes the timer and cancels the work before freeing cfg in brcmf_cfg80211_detach.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source; confirm that brcmf_cfg80211_detach now calls del_timer_sync and cancel_work_sync before kfree(cfg); test hotplug disconnect during escan operations.

Typical attack path

1. Gain local access to a system with brcmfmac USB WiFi
2. Initiate or wait for an escan operation that schedules the timeout worker
3. Trigger USB disconnect via physical removal or software hotplug
4. Worker executes after free and accesses dangling cfg pointer

How to detect it

Inspect kernel logs for oops/panic traces mentioning brcmf_cfg80211_escan_timeout_worker or use-after-free in brcmfmac; review dmesg and syslog around USB disconnect events.

What your security team should do

• Prioritize kernel updates on all systems with Broadcom USB WiFi hardware
• Disable the brcmfmac driver if USB WiFi is not required
• Monitor for kernel oops or panic logs related to brcmf_cfg80211_escan_timeout_worker