The Linux kernel's brcmfmac wifi driver function brcmf_notify_auth_frame_rx() improperly handles the length of received authentication frames. It calculates the management frame length by subtracting the size of a management data structure from the firmware event's datalen without ensuring the result is above the offset of the ieee80211_mgmt union member. If the frame is shorter than this offset (24 bytes), the subtraction wraps around as an unsigned integer to a large value, causing memcpy to copy far beyond the allocated buffer. This heap overflow can be triggered remotely by a malicious or malfunctioning access point during the external SAE authentication exchange. The vulnerability is addressed by rejecting frames shorter than the management header offset before performing the copy.

A remote attacker controlling or impersonating an access point can trigger a heap overflow in the Linux kernel wifi driver during authentication frame processing. This memory corruption could potentially lead to denial of service or code execution, depending on exploitation conditions. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves rejecting frames shorter than the management header offset before copying, which addresses the heap overflow. Users should monitor official Linux kernel advisories for patches that implement this fix.