CVE-2026-90345

What it actually does

Missing null checks and fallback logic when P2P device vif is absent allow invalid memory dereferences or accesses to uninitialized saved IEs during action frame abort or peer channel search in brcmfmac.

Why it matters to the business

Local or wireless-adjacent attackers may trigger kernel crashes, denial of service, or memory corruption on Linux systems using Broadcom WiFi chips, disrupting network connectivity and requiring reboots or patches.

How an attack unfolds

An attacker transmits non-P2P public action frames through the primary interface or forces an action-frame abort before the P2P device vif is created; the driver then dereferences a null or stale vif pointer or accesses unguarded saved IEs, resulting in memory corruption.

How to fix it

Apply the upstream Linux kernel patch that adds primary-vif fallback on abort and guards all P2P device saved-IE accesses; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

Confirm the fix is present by inspecting brcmfmac P2P action-frame handling code for the added vif-null checks and primary-interface fallback; test by sending non-P2P frames and verifying no crashes occur.

Typical attack path

1. Establish association via primary WiFi interface
2. Transmit crafted non-P2P public action frames or trigger abort conditions
3. Cause driver to follow P2P paths without valid device vif
4. Trigger invalid memory access leading to corruption or crash

How to detect it

Search kernel logs and dmesg for brcmfmac P2P-related null pointer dereferences, invalid vif accesses, or action-frame abort warnings; correlate with wireless frame injection events.

What your security team should do

• Prioritize kernel updates on all systems using brcmfmac
• Monitor kernel logs for brcmfmac oops or warnings related to P2P vif
• Restrict unprivileged wireless frame injection where possible