{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-99061", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-99061", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-10-23T12:22:59.770Z", "updatedAt": "2026-10-23T12:22:59.770Z", "importedAt": "2026-10-24T01:58:41.756Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n and calls brcmf_remove_interface(ifp, false) for the same ifp.\n brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on\n rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n cfg80211_unregister_wdev() on the wdev that was already unregistered\n and freed.\n\nThe second list_del_rcu() of wdev->list faults on LIST_POISON2:\n\n brcmfmac: brcmf_p2p_del_vif delete P2P vif\n brcmfmac: brcmf_p2p_deinit_discovery enter\n brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n brcmfmac: brcmf_detach Enter\n brcmfmac: brcmf_bus_change_state 1 -> 0\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n [1.5 s later, brcmf_p2p_del_vif() timed out]\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n Unable to handle kernel paging request at virtual address dead000000000122\n Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n Call trace:\n _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n brcmf_detach+0x88/0x180 [brcmfmac]\n brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n sdio_bus_remove+0x38/0x144\n device_release_driver_internal+0x1e8/0x2c0\n device_release_driver+0x14/0x20\n brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n __exit_compat+0x18/0x418 [brcmfmac_cyw]\n __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug=0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n 1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n P2P device (iw dev shows \"type P2P-device\").\n 2. Stop wpa_supplicant and remove the driver without waiting for\n wpa_supplicant to exit:\n\n kill $(pidof wpa_supplicant)\n rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "9831bcb987df4aff6a1d85975f1dda4c654f298d", "status": "affected", "versionType": "git", "lessThan": "7b79131e357c4786765b20a994ad40d4d35f2163" }, { "version": "9831bcb987df4aff6a1d85975f1dda4c654f298d", "status": "affected", "versionType": "git", "lessThan": "2e0c8c60a11b3177e7432c71d41249e276a0825f" }, { "version": "9831bcb987df4aff6a1d85975f1dda4c654f298d", "status": "affected", "versionType": "git", "lessThan": "eef16a74ff8ed2a838d6bb862bb2c7783fce7466" }, { "version": "9831bcb987df4aff6a1d85975f1dda4c654f298d", "status": "affected", "versionType": "git", "lessThan": "47ca6395a1d91545cc9403f9218bc61be941a0c3" }, { "version": "9831bcb987df4aff6a1d85975f1dda4c654f298d", "status": "affected", "versionType": "git", "lessThan": "08a3f02fea636e97a7422d1512f76dacdb5b0887" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.4", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.4" }, { "version": "6.6.160", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.113", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.57", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.2.11", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.2.*" }, { "version": "7.3", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }