CVE-2025-21750 is a vulnerability identified in the Linux kernel's Broadcom FullMAC wireless driver (brcmfmac), specifically related to the handling of device tree properties in the function brcmf_of_probe. The issue arises because the driver fails to properly check the return value of the function of_property_read_string_index(), which reads a string property from the device tree. When this property is missing, the variable 'tmp' remains uninitialized, leading to the passing of a random pointer to devm_kstrdup(). This results in a kernel crash due to a page fault triggered by an invalid memory access. The crash manifests as a BUG report with a supervisor read access violation in kernel mode, causing an 'Oops' error and kernel panic. The problem was observed on a MacBookPro14,3 running Linux kernel version 6.11.8-gentoo, but the vulnerability affects Linux kernel versions between 6.10 and 6.11 where this driver code was introduced or modified. The root cause is a lack of input validation and error handling in the driver code, which leads to dereferencing uninitialized pointers. Although this vulnerability currently does not have known exploits in the wild, it can cause denial of service (DoS) by crashing the kernel. Since the flaw is in a kernel driver, exploitation could potentially be triggered by local users or processes interacting with the wireless driver or device tree properties, possibly requiring specific hardware or configurations. The vulnerability is resolved by adding proper checks for the return value of of_property_read_string_index() to ensure 'tmp' is initialized safely before use. No CVSS score is assigned yet, but the technical details indicate a stability and availability impact due to kernel crashes.

For European organizations, this vulnerability primarily poses a risk of denial of service on Linux systems using affected kernel versions with Broadcom FullMAC wireless drivers. Organizations relying on Linux servers, workstations, or embedded devices with these drivers could experience unexpected kernel panics leading to system downtime, impacting availability of critical services. This is particularly relevant for industries with high Linux adoption such as telecommunications, manufacturing, and research institutions. Although the vulnerability does not directly expose confidentiality or integrity risks, the resulting instability could disrupt operations and require emergency patching or system reboots. Additionally, if exploited in a targeted manner, attackers could use this flaw to cause persistent outages or disrupt wireless connectivity on affected devices. The lack of known exploits reduces immediate risk, but the presence of this vulnerability in the Linux kernel means that organizations should prioritize patching to maintain system reliability. The impact is more pronounced in environments where kernel stability is critical and where Broadcom wireless chipsets are common, including laptops and embedded systems used in industrial or enterprise settings.

1. Immediate patching: Apply the latest Linux kernel updates that include the fix for CVE-2025-21750. Ensure that all systems running affected kernel versions (6.10 to 6.11) are upgraded to versions where the brcmfmac driver properly checks the return value of of_property_read_string_index(). 2. Kernel version management: Avoid running unpatched or development kernel versions in production environments, especially those with Broadcom wireless hardware. 3. Hardware inventory and driver audit: Identify systems using Broadcom FullMAC wireless chipsets and verify the kernel driver versions in use. 4. Controlled testing: Before deploying kernel updates, test patches in staging environments to confirm stability and compatibility with existing hardware. 5. Access control: Limit local user privileges to reduce the risk of triggering the vulnerability via user-space interactions with the wireless driver. 6. Monitoring and alerting: Implement kernel crash monitoring and alerting to detect any unexpected Oops or panic events related to wireless drivers. 7. Alternative drivers or hardware: Where feasible, consider using alternative wireless drivers or hardware that are not affected by this vulnerability to reduce exposure. 8. Incident response readiness: Prepare for potential denial of service incidents by having rollback plans and backup systems to minimize operational disruption.