CVE-2026-99061 (GCVE-0-2026-99061)
Vulnerability from cvelistv5
Published
2026-10-23 12:22
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
When the driver is removed while the user space process that created
the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device
interface is removed twice and the kernel crashes.
The two paths are:
- wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P
device. nl80211_del_interface() holds RTNL and the wiphy mutex and
calls brcmf_p2p_del_vif(), which disables discovery and waits up to
1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),
which unregisters the wdev and frees the vif and the ifp.
- brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,
and calls brcmf_remove_interface(ifp, false) for the same ifp.
brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on
rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls
cfg80211_unregister_wdev() on the wdev that was already unregistered
and freed.
The second list_del_rcu() of wdev->list faults on LIST_POISON2:
brcmfmac: brcmf_p2p_del_vif delete P2P vif
brcmfmac: brcmf_p2p_deinit_discovery enter
brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared
brcmfmac: brcmf_detach Enter
brcmfmac: brcmf_bus_change_state 1 -> 0
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed
[1.5 s later, brcmf_p2p_del_vif() timed out]
brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed
Unable to handle kernel paging request at virtual address dead000000000122
Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP
pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]
Call trace:
_cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]
cfg80211_unregister_wdev+0x10/0x1c [cfg80211]
brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]
brcmf_remove_interface+0x1f4/0x254 [brcmfmac]
brcmf_detach+0x88/0x180 [brcmfmac]
brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]
brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]
brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]
sdio_bus_remove+0x38/0x144
device_release_driver_internal+0x1e8/0x2c0
device_release_driver+0x14/0x20
brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]
brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]
__exit_compat+0x18/0x418 [brcmfmac_cyw]
__arm64_sys_delete_module+0x1ac/0x244
The log was taken with debug=0x406 on an i.MX 8M Plus board with a
CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of
brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same
in mainline.
To reproduce:
1. Start wpa_supplicant on wlan0 and let it associate. It creates the
P2P device (iw dev shows "type P2P-device").
2. Stop wpa_supplicant and remove the driver without waiting for
wpa_supplicant to exit:
kill $(pidof wpa_supplicant)
rmmod brcmfmac_cyw brcmfmac
The crash is reproducible on that board.
For the interface without a netdev (the P2P device), take RTNL and the
wiphy mutex in brcmf_detach() before reading iflist, and remove it with
locked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the
slot empty. If brcmf_detach() runs first, nl80211 does not find the wdev
any more. The interfaces with a netdev are removed as before, because
brcmf_del_if() takes RTNL on its own for the primary interface.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d Version: 9831bcb987df4aff6a1d85975f1dda4c654f298d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75e917473e20dea61f837f9afb5fc3435c9200d2",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "c4c0659eb74f807e0e73742b101a07b0bb703d97",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "0f84eec09039deb9229fd35c55912a2397d3ae55",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "7b79131e357c4786765b20a994ad40d4d35f2163",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "2e0c8c60a11b3177e7432c71d41249e276a0825f",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "eef16a74ff8ed2a838d6bb862bb2c7783fce7466",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "47ca6395a1d91545cc9403f9218bc61be941a0c3",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
},
{
"lessThan": "08a3f02fea636e97a7422d1512f76dacdb5b0887",
"status": "affected",
"version": "9831bcb987df4aff6a1d85975f1dda4c654f298d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n and calls brcmf_remove_interface(ifp, false) for the same ifp.\n brcmf_p2p_ifp_removed() reads ifp-\u003evif and then blocks on\n rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n cfg80211_unregister_wdev() on the wdev that was already unregistered\n and freed.\n\nThe second list_del_rcu() of wdev-\u003elist faults on LIST_POISON2:\n\n brcmfmac: brcmf_p2p_del_vif delete P2P vif\n brcmfmac: brcmf_p2p_deinit_discovery enter\n brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n brcmfmac: brcmf_detach Enter\n brcmfmac: brcmf_bus_change_state 1 -\u003e 0\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n [1.5 s later, brcmf_p2p_del_vif() timed out]\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n Unable to handle kernel paging request at virtual address dead000000000122\n Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n Call trace:\n _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n brcmf_detach+0x88/0x180 [brcmfmac]\n brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n sdio_bus_remove+0x38/0x144\n device_release_driver_internal+0x1e8/0x2c0\n device_release_driver+0x14/0x20\n brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n __exit_compat+0x18/0x418 [brcmfmac_cyw]\n __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug=0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n 1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n P2P device (iw dev shows \"type P2P-device\").\n 2. Stop wpa_supplicant and remove the driver without waiting for\n wpa_supplicant to exit:\n\n kill $(pidof wpa_supplicant)\n rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:26.663Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75e917473e20dea61f837f9afb5fc3435c9200d2"
},
{
"url": "https://git.kernel.org/stable/c/c4c0659eb74f807e0e73742b101a07b0bb703d97"
},
{
"url": "https://git.kernel.org/stable/c/0f84eec09039deb9229fd35c55912a2397d3ae55"
},
{
"url": "https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163"
},
{
"url": "https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f"
},
{
"url": "https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466"
},
{
"url": "https://git.kernel.org/stable/c/47ca6395a1d91545cc9403f9218bc61be941a0c3"
},
{
"url": "https://git.kernel.org/stable/c/08a3f02fea636e97a7422d1512f76dacdb5b0887"
}
],
"title": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99061",
"datePublished": "2026-10-23T12:22:59.770Z",
"dateReserved": "2026-09-25T10:25:14.388Z",
"dateUpdated": "2026-10-30T12:41:26.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…