In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is… (CVE-2026-99061)

The vulnerability in the Linux kernel's brcmfmac WiFi driver arises from a race condition during P2P device removal in the brcmf_detach() function. When the driver is removed while a user space process such as wpa_supplicant is still exiting, the P2P device interface is removed twice. One path involves wpa_supplicant sending NL80211_CMD_DEL_INTERFACE, which leads to disabling discovery and removing the interface. The other path is brcmf_detach() setting the bus down and removing the interface independently. This causes a double free and subsequent kernel crash due to accessing freed memory (LIST_POISON2). The issue was reproducible on an i.MX 8M Plus board with a CYW55513 device and affects the Ezurio backport of brcmfmac from v6.18.22 on a 5.4-rt kernel, with the same code present in mainline. The fix involves taking RTNL and wiphy mutexes in brcmf_detach() before reading the interface list and removing the interface with locked=true to avoid the race.

The vulnerability causes a kernel crash (kernel oops) due to a double removal and use-after-free of the P2P device interface in the brcmfmac driver. This can lead to denial of service on affected systems when the driver is removed while a user space process managing the P2P device is still exiting. No information about privilege escalation or remote code execution is provided.

A fix has been implemented in the Linux kernel source code to properly synchronize the removal of the P2P device interface by taking RTNL and wiphy mutexes in brcmf_detach() and removing the interface with locked=true. Users should update to a kernel version that includes this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mainline or distribution kernel updates for the official fix. Until patched, avoid removing the brcmfmac driver while user space processes managing P2P devices (e.g., wpa_supplicant) are still running or exiting.