CVE-2026-43110

What it actually does

This is a Linux kernel memory-corruption flaw in the Broadcom FullMAC Wi-Fi driver, brcmfmac. The driver validates one firmware-supplied interface index before accessing its internal interface list, but it fails to apply an equivalent bounds check to the firmware-supplied bsscfg index. A malformed or unexpected Wi-Fi firmware interface event can therefore cause an out-of-bounds access to the driver interface array. In kernel context, that can lead to denial of service through a kernel crash and, depending on layout, hardening, and exploitability on a given platform, may permit kernel memory disclosure or arbitrary kernel memory modification with full system compromise. The CVSS vector indicates adjacent-network exploitation with no privileges or user interaction required, so practical exposure is limited to systems using affected Broadcom Wi-Fi hardware and driver paths within wireless range of an attacker or exposed to compromised/malicious Wi-Fi firmware behavior.

Why it matters to the business

Systems using affected Linux kernels with Broadcom brcmfmac Wi-Fi support may be vulnerable to crashes or potential full device compromise from a nearby attacker over the wireless attack surface. This can disrupt laptops, embedded Linux devices, kiosks, IoT devices, routers, appliances, and operational technology endpoints that rely on Wi-Fi connectivity. Although the current EPSS score is low and no known exploited status or public exploit maturity is reported, the high CVSS score and kernel-level impact make this important for fleets with Broadcom Wi-Fi hardware, especially unmanaged or physically exposed devices.

How an attack unfolds

An attacker first needs proximity to a vulnerable device using the brcmfmac driver, or another way to influence the Broadcom Wi-Fi firmware event stream. The attacker causes the Wi-Fi stack or firmware to emit an interface event containing a valid enough interface context to reach brcmf_fweh_handle_if_event(), but with an invalid bsscfg index. Because the driver checks the interface index but then uses the raw bsscfgidx value as an array index, the kernel may access memory outside drvr->iflist[]. The immediate result may be a kernel oops, panic, device reboot, or Wi-Fi subsystem failure. On platforms where the out-of-bounds access can be shaped reliably, exploitation could potentially progress from memory corruption to kernel-level code execution or privilege escalation, giving the attacker control over the affected system.

How to fix it

Apply a Linux kernel update from the operating system, device, or appliance vendor that includes the brcmfmac fix adding range validation for bsscfg indices in IF event handling. Because no exact fixed package versions were provided, track vendor advisories for the relevant distribution or product line and update to the first kernel build that includes the upstream brcmfmac patch for validating bsscfg indices before indexing drvr->iflist[]. Where immediate patching is not possible, reduce exposure by disabling Wi-Fi on affected systems, unloading or blacklisting the brcmfmac module where operationally acceptable, using wired networking, limiting use of devices in untrusted wireless environments, and prioritizing replacement or firmware/kernel updates for internet-of-things and embedded devices that may not receive regular kernel maintenance. Kernel hardening features such as KASLR, SMEP/SMAP, hardened slab allocators, and lockdown can reduce exploit reliability but should not be considered complete mitigations.

How to confirm the fix worked

Confirm whether systems load the brcmfmac driver and run a kernel build containing the vendor fix. On Linux systems, check loaded modules with commands such as lsmod | grep brcmfmac, inspect hardware with lspci or lsusb for Broadcom Wi-Fi adapters, and review the installed kernel package changelog or vendor advisory for the brcmfmac bsscfg index validation patch. Validate remediation by booting into the updated kernel, confirming the old vulnerable kernel is not the default boot target, and ensuring brcmfmac.ko comes from the updated kernel module tree. For appliances and embedded devices, verify the vendor firmware image release notes include the Linux kernel brcmfmac fix. Exposure is highest where brcmfmac is loaded and Wi-Fi is enabled; systems without Broadcom FullMAC Wi-Fi hardware or without the brcmfmac module in use are unlikely to be exploitable through this path.

Typical attack path

1. Identify devices using Linux with Broadcom FullMAC Wi-Fi hardware handled by the brcmfmac driver.
2. Move within wireless range of the target device or otherwise gain a position that can influence Wi-Fi firmware events.
3. Trigger Wi-Fi interface-related events, such as association, disassociation, virtual interface, or firmware event handling paths, with malformed bsscfg index values.
4. Cause brcmf_fweh_handle_if_event() to process the crafted event and index drvr->iflist[] out of bounds.
5. Achieve a denial of service through kernel crash/reboot, or attempt to shape the memory corruption for kernel memory disclosure or code execution.
6. If code execution is achieved, establish persistence or pivot using kernel-level privileges.

How to detect it

Post-exploitation detection is difficult because the vulnerable path is inside the kernel Wi-Fi driver and may leave only crash or kernel telemetry rather than conventional application logs. Review system journals, kernel ring buffers, crash dumps, pstore, netconsole, kdump/vmcore artifacts, and endpoint telemetry for brcmfmac-related faults. Focus on events involving brcmf_fweh_handle_if_event(), brcmfmac firmware events, interface events, bsscfg index references, KASAN slab or array out-of-bounds reports, general protection faults, NULL pointer dereferences, and kernel oops or panics shortly after Wi-Fi scanning, association, roaming, disassociation, hotspot activity, or virtual interface changes. Correlate timestamps with wireless logs, NetworkManager or wpa_supplicant events, access point logs, and RF monitoring data for suspicious nearby activity, repeated association failures, unusual deauthentication/disassociation bursts, or crashes occurring only in specific physical locations. If a crash dump is available, analyze the stack trace for brcmfmac/brcmf_fweh frames and inspect whether the faulting access is near the driver interface list. Absence of these artifacts does not prove non-exploitation, especially if the system rebooted without persistent kernel logging enabled.

• brcmfmac
• brcmf_fweh_handle_if_event
• brcmf_fweh
• bsscfgidx
• bsscfg
• drvr->iflist
• KASAN: slab-out-of-bounds
• KASAN: global-out-of-bounds
• BUG: unable to handle kernel
• general protection fault
• kernel NULL pointer dereference
• Kernel panic - not syncing
• Oops:
• Call Trace:
• brcmfmac.ko
• /lib/modules/*/kernel/drivers/net/wireless/broadcom/brcm80211/brcmfmac/brcmfmac.ko
• wlan0: deauthenticating
• wlan0: disassociated
• wpa_supplicant
• NetworkManager

What your security team should do

• Inventory Linux endpoints, embedded devices, and appliances that use Broadcom Wi-Fi hardware or load the brcmfmac kernel module.
• Prioritize patching mobile, kiosk, IoT, and physically exposed systems that use Wi-Fi in public or untrusted radio environments.
• Deploy vendor kernel or firmware updates that include the brcmfmac bsscfg index validation fix; ensure systems reboot into the fixed kernel.
• Temporarily disable Wi-Fi or blacklist brcmfmac on high-risk systems that cannot be patched and do not require Broadcom Wi-Fi connectivity.
• Monitor kernel logs and crash telemetry for brcmfmac-related oops, panic, KASAN, or general protection fault events, especially following Wi-Fi association or roaming activity.
• Review wireless security posture for exposed device classes, including limiting operation in hostile RF environments and preferring wired connectivity for critical systems.
• Because no known exploitation is reported and EPSS is low, handle this as high-impact, targeted-risk remediation rather than broad emergency response unless affected Broadcom Wi-Fi devices are mission-critical or physically exposed.