Cloudanix VulnDB

CVE-2026-98350

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in some Linux WiFi drivers could let internal system data reach the wireless hardware or cause network connections to be refused.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uninitialized stack memory (garbage values) is passed to the firmware via auth_status when SSID length is under 32 bytes or PMKID is supplied; the driver also fails to forward a valid PMKID, causing the firmware to cache garbage and reject later association requests that include the PMKID.

Why it matters to the business

Possible disclosure of kernel stack contents to wireless firmware and intermittent failure of WiFi client associations on Broadcom-based devices, leading to connectivity outages for users or IoT fleets.

How an attack unfolds

An attacker initiates 802.11 authentication with a short SSID or supplied PMKID; the driver leaks uninitialized stack bytes to firmware and omits the real PMKID, allowing the firmware to store invalid data that later blocks legitimate association attempts.

How to fix it

Apply the upstream Linux kernel patch that zeros auth_status on initialization and forwards params->pmkid when present; rebuild and deploy the updated brcmfmac module.

How to confirm the fix worked

After patching, review the brcmfmac cyw authentication code to confirm auth_status is explicitly zeroed and that PMKID is passed to firmware; test association flows with short SSIDs and PMKIDs.

Typical attack path

  1. Send 802.11 authentication frame with SSID shorter than 32 bytes or with PMKID present
  2. Trigger the uninitialized auth_status path in brcmfmac cyw
  3. Observe firmware caching invalid PMKID and subsequent association denials

How to detect it

Search kernel logs and driver traces for brcmfmac authentication events involving unexpected auth_status values or repeated PMKID-related association failures.

What your security team should do

  • Prioritize kernel updates for systems using Broadcom WiFi chips
  • Monitor WiFi association failure rates in logs
  • Test driver behavior under short-SSID and PMKID conditions before wide deployment

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: pass PMKID to firmware if present Zero out auth_status on initialization. Otherwise, garbage will leak from the stack to the firmware (when ssid is less than 32 bytes and/or when params->pmkid is set). Then, pass the params->pmkid to the firmware (without it, the firmware caches a garbage PMKID on successful authentication and denies a subsequent association request that includes the PMKID).

Affected packages

Ecosystem Package Introduced Fixed