CVE-2024-35811 is a use-after-free vulnerability in the Linux kernel's Broadcom wireless driver (brcmfmac), specifically within the brcmf_cfg80211_detach function. The vulnerability arises during the USB hotplug disconnect sequence of the Broadcom wireless device. When the USB device is disconnected, the driver initiates a cleanup process that frees the memory structure 'cfg' used by the wireless driver. However, a timeout worker function (brcmf_cfg80211_escan_timeout_worker), which is scheduled during the initialization of the wireless scanning functionality, may still be running concurrently. This worker accesses the 'cfg' structure after it has been freed, leading to a use-after-free condition. This can cause undefined behavior including kernel crashes, memory corruption, or potentially arbitrary code execution in kernel context. The root cause is the lack of proper synchronization and cancellation of the timeout worker before freeing the associated memory during device detachment. The fix involves deleting the timer and canceling the worker thread before freeing the 'cfg' structure, ensuring no concurrent access occurs post-free. This vulnerability is related to the brcm80211 driver stack and affects Linux kernel versions containing the vulnerable commit identified by the hash e756af5b30b008f6ffcfebf8ad0b477f6f225b62. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the affected Broadcom wireless driver versions, especially those using USB-connected Broadcom Wi-Fi devices. The use-after-free bug can lead to system instability or crashes, potentially causing denial of service on critical infrastructure or endpoints. More severely, if exploited, it could allow an attacker with local access or the ability to trigger USB device disconnect events to execute arbitrary code in kernel mode, compromising system confidentiality and integrity. This is particularly concerning for organizations relying on Linux-based servers, embedded devices, or workstations with Broadcom wireless hardware. Given the widespread use of Linux in enterprise environments, including cloud infrastructure and IoT devices, the vulnerability could impact network reliability and security. However, exploitation requires triggering USB hotplug events and timing the worker execution, which may limit remote exploitation scenarios. Still, insider threats or malicious USB devices could leverage this flaw. The vulnerability also affects the availability of services dependent on wireless connectivity, which could disrupt business operations.

European organizations should promptly apply the official Linux kernel patches that address CVE-2024-35811 by ensuring their systems are updated to kernel versions containing the fix. Specifically, the patch cancels the timeout worker and deletes the timer before freeing memory during device detachment. Organizations should audit their Linux systems to identify those using Broadcom USB wireless devices and verify kernel versions against the fixed commit. For environments where immediate patching is not feasible, temporary mitigations include disabling USB hotplug functionality for Broadcom wireless devices or unloading the brcmfmac driver when not in use to prevent triggering the vulnerability. Additionally, implementing strict USB device control policies can reduce the risk of malicious USB device insertion or disconnection events. Monitoring kernel logs for unusual USB disconnects or driver errors may help detect attempted exploitation. Finally, organizations should maintain robust endpoint security controls and limit local user privileges to reduce the attack surface.