GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-39863 (GCVE-0-2025-39863)

Vulnerability from cvelistv5 – Published: 2025-09-19 15:26 – Updated: 2026-08-05 12:05
VLAI
Title
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions: 1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync(). 2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs. The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread. Scenario 1: Freed before the worker is scheduled The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is detailed below: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | | schedule_work(&bt_local->work); // USE Scenario 2: Freed after the worker is scheduled The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule | kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ | To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then set to false.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 19:23 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 61730d4dfffc2cc9d3a49fad87633008105c18ba , < c75600e69e66a751cc046cd9c407b942f298d852 (git)
Affected: 61730d4dfffc2cc9d3a49fad87633008105c18ba , < ae58f70bde0433f27ef4b388ab50634736607bf6 (git)
Affected: 61730d4dfffc2cc9d3a49fad87633008105c18ba , < f1150153c4e5940fe49ab51136343c5b4fe49d63 (git)
Affected: 61730d4dfffc2cc9d3a49fad87633008105c18ba , < 3e789f8475f6c857c88de5c5bf4b24b11a477dd7 (git)
Affected: 61730d4dfffc2cc9d3a49fad87633008105c18ba , < 2f6fbc8e04ca1d1d5c560be694199f847229c625 (git)
Affected: 61730d4dfffc2cc9d3a49fad87633008105c18ba , < 9cb83d4be0b9b697eae93d321e0da999f9cdfcfc (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.105 , ≤ 6.6.* (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.16.6 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39863",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:23:53.735650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:11.612Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c75600e69e66a751cc046cd9c407b942f298d852",
              "status": "affected",
              "version": "61730d4dfffc2cc9d3a49fad87633008105c18ba",
              "versionType": "git"
            },
            {
              "lessThan": "ae58f70bde0433f27ef4b388ab50634736607bf6",
              "status": "affected",
              "version": "61730d4dfffc2cc9d3a49fad87633008105c18ba",
              "versionType": "git"
            },
            {
              "lessThan": "f1150153c4e5940fe49ab51136343c5b4fe49d63",
              "status": "affected",
              "version": "61730d4dfffc2cc9d3a49fad87633008105c18ba",
              "versionType": "git"
            },
            {
              "lessThan": "3e789f8475f6c857c88de5c5bf4b24b11a477dd7",
              "status": "affected",
              "version": "61730d4dfffc2cc9d3a49fad87633008105c18ba",
              "versionType": "git"
            },
            {
              "lessThan": "2f6fbc8e04ca1d1d5c560be694199f847229c625",
              "status": "affected",
              "version": "61730d4dfffc2cc9d3a49fad87633008105c18ba",
              "versionType": "git"
            },
            {
              "lessThan": "9cb83d4be0b9b697eae93d321e0da999f9cdfcfc",
              "status": "affected",
              "version": "61730d4dfffc2cc9d3a49fad87633008105c18ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\n\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\nruns as timer handler, sets timer_on to false. This creates critical\nrace conditions:\n\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\nis executing, it may observe timer_on as false and skip the call to\ntimer_shutdown_sync().\n\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\nworker after the cancel_work_sync() has been executed, resulting in\nuse-after-free bugs.\n\nThe use-after-free bugs occur in two distinct scenarios, depending on\nthe timing of when the brcmf_btcoex_info struct is freed relative to\nthe execution of its worker thread.\n\nScenario 1: Freed before the worker is scheduled\n\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\nA race condition can occur when schedule_work(\u0026bt_local-\u003ework) is\ncalled after the target memory has been freed. The sequence of events\nis detailed below:\n\nCPU0                           | CPU1\nbrcmf_btcoex_detach            | brcmf_btcoex_timerfunc\n                               |   bt_local-\u003etimer_on = false;\n  if (cfg-\u003ebtcoex-\u003etimer_on)   |\n    ...                        |\n  cancel_work_sync();          |\n  ...                          |\n  kfree(cfg-\u003ebtcoex); // FREE  |\n                               |   schedule_work(\u0026bt_local-\u003ework); // USE\n\nScenario 2: Freed after the worker is scheduled\n\nThe brcmf_btcoex_info is freed after the worker has been scheduled\nbut before or during its execution. In this case, statements within\nthe brcmf_btcoex_handler() \u2014 such as the container_of macro and\nsubsequent dereferences of the brcmf_btcoex_info object will cause\na use-after-free access. The following timeline illustrates this\nscenario:\n\nCPU0                            | CPU1\nbrcmf_btcoex_detach             | brcmf_btcoex_timerfunc\n                                |   bt_local-\u003etimer_on = false;\n  if (cfg-\u003ebtcoex-\u003etimer_on)    |\n    ...                         |\n  cancel_work_sync();           |\n  ...                           |   schedule_work(); // Reschedule\n                                |\n  kfree(cfg-\u003ebtcoex); // FREE   |   brcmf_btcoex_handler() // Worker\n  /*                            |     btci = container_of(....); // USE\n   The kfree() above could      |     ...\n   also occur at any point      |     btci-\u003e // USE\n   during the worker\u0027s execution|\n   */                           |\n\nTo resolve the race conditions, drop the conditional check and call\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\nregardless of its current state. Once stopped, the timer_on state is\nthen set to false."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is armed through a local nl80211/netlink command (NL80211_CMD_CRIT_PROTOCOL_START) on the local wireless device and freed through a local driver teardown/bus-reset path; no remote or adjacent-network frame reaches `brcmf_btcoex_detach()` or arms the btcoex timer directly. Although an adjacent attacker can induce the free side by halting the firmware (`BRCMF_D2H_DEV_FWHALT` \u2192 `brcmf_fw_crashed()` \u2192 `brcmf_bus_reset()`), a single attacker capable of both halves of the race operates locally.\nAC:L - The attacker controls both sides: the crit-proto `duration` makes the handler arm the timer at a deterministic `jiffies + 2s`, so the callback\u0027s execution moment is known in advance, and the same actor drives the teardown (bus reset / driver unbind / firmware halt) to land inside it. The attempt is cheap to repeat in a loop until the window is hit, and the freed `kmalloc-192` object can be sprayed with standard heap-grooming syscalls.\nPR:L - `NL80211_CMD_CRIT_PROTOCOL_START` carries `GENL_UNS_ADMIN_PERM` (CAP_NET_ADMIN), which on Android and embedded targets is held by the confined non-root Wi-Fi/supplicant service account rather than by real root in the init namespace, and the free side can be reached without root by making the firmware halt. Basic account-level access with that delegated network capability is sufficient, so this is Low rather than High.\nUI:N - The attacker issues the crit-proto start and triggers the teardown itself; no victim needs to mount a filesystem, open a file, or take any other action for the use-after-free to occur.\nS:U - The freed object, the corrupted slab, and the hijacked workqueue dispatch all live within the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other protection domain.\nC:H - The use-after-free lets the attacker reoccupy the freed `brcmf_btcoex_info` slot, after which `brcmf_btcoex_handler()` dereferences attacker-chosen `btci-\u003evif`, `btci-\u003evif-\u003eifp`, and `btci-\u003ecfg-\u003epub` pointers, yielding an arbitrary kernel-memory read primitive and disclosure of kernel addresses.\nI:H - `process_one_work()` loads `work-\u003efunc` out of the freed structure and calls it (`worker-\u003ecurrent_func = work-\u003efunc; worker-\u003ecurrent_func(work);`), so a resprayed slot gives a controlled indirect call, and `schedule_work()` on freed memory additionally corrupts worker-pool list linkage \u2014 a full control-flow-hijack and arbitrary-write primitive.\nA:H - Even without successful grooming, scheduling and executing work on a kfree\u0027d object dereferences poisoned/recycled memory and reliably produces a KASAN splat, oops, or kernel panic, taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:43.455Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc"
        }
      ],
      "title": "wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39863",
    "datePublished": "2025-09-19T15:26:33.069Z",
    "dateReserved": "2025-04-16T07:20:57.143Z",
    "dateUpdated": "2026-08-05T12:05:43.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39863",
      "date": "2026-09-16",
      "epss": "0.00158",
      "percentile": "0.05364"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:59:50.000Z",
      "cve": "CVE-2025-39863",
      "id": "msrc_CVE-2025-39863",
      "initial_release_date": "2025-09-21T01:02:41.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39863.json",
      "version": "6"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39863\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-19T16:15:45.310\",\"lastModified\":\"2026-06-19T13:16:22.500\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\\n\\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\\nruns as timer handler, sets timer_on to false. This creates critical\\nrace conditions:\\n\\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\\nis executing, it may observe timer_on as false and skip the call to\\ntimer_shutdown_sync().\\n\\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\\nworker after the cancel_work_sync() has been executed, resulting in\\nuse-after-free bugs.\\n\\nThe use-after-free bugs occur in two distinct scenarios, depending on\\nthe timing of when the brcmf_btcoex_info struct is freed relative to\\nthe execution of its worker thread.\\n\\nScenario 1: Freed before the worker is scheduled\\n\\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\\nA race condition can occur when schedule_work(\u0026bt_local-\u003ework) is\\ncalled after the target memory has been freed. The sequence of events\\nis detailed below:\\n\\nCPU0                           | CPU1\\nbrcmf_btcoex_detach            | brcmf_btcoex_timerfunc\\n                               |   bt_local-\u003etimer_on = false;\\n  if (cfg-\u003ebtcoex-\u003etimer_on)   |\\n    ...                        |\\n  cancel_work_sync();          |\\n  ...                          |\\n  kfree(cfg-\u003ebtcoex); // FREE  |\\n                               |   schedule_work(\u0026bt_local-\u003ework); // USE\\n\\nScenario 2: Freed after the worker is scheduled\\n\\nThe brcmf_btcoex_info is freed after the worker has been scheduled\\nbut before or during its execution. In this case, statements within\\nthe brcmf_btcoex_handler() \u2014 such as the container_of macro and\\nsubsequent dereferences of the brcmf_btcoex_info object will cause\\na use-after-free access. The following timeline illustrates this\\nscenario:\\n\\nCPU0                            | CPU1\\nbrcmf_btcoex_detach             | brcmf_btcoex_timerfunc\\n                                |   bt_local-\u003etimer_on = false;\\n  if (cfg-\u003ebtcoex-\u003etimer_on)    |\\n    ...                         |\\n  cancel_work_sync();           |\\n  ...                           |   schedule_work(); // Reschedule\\n                                |\\n  kfree(cfg-\u003ebtcoex); // FREE   |   brcmf_btcoex_handler() // Worker\\n  /*                            |     btci = container_of(....); // USE\\n   The kfree() above could      |     ...\\n   also occur at any point      |     btci-\u003e // USE\\n   during the worker\u0027s execution|\\n   */                           |\\n\\nTo resolve the race conditions, drop the conditional check and call\\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\\nregardless of its current state. Once stopped, the timer_on state is\\nthen set to false.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"61730d4dfffc2cc9d3a49fad87633008105c18ba\",\"lessThan\":\"c75600e69e66a751cc046cd9c407b942f298d852\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61730d4dfffc2cc9d3a49fad87633008105c18ba\",\"lessThan\":\"ae58f70bde0433f27ef4b388ab50634736607bf6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61730d4dfffc2cc9d3a49fad87633008105c18ba\",\"lessThan\":\"f1150153c4e5940fe49ab51136343c5b4fe49d63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61730d4dfffc2cc9d3a49fad87633008105c18ba\",\"lessThan\":\"3e789f8475f6c857c88de5c5bf4b24b11a477dd7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61730d4dfffc2cc9d3a49fad87633008105c18ba\",\"lessThan\":\"2f6fbc8e04ca1d1d5c560be694199f847229c625\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61730d4dfffc2cc9d3a49fad87633008105c18ba\",\"lessThan\":\"9cb83d4be0b9b697eae93d321e0da999f9cdfcfc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.105\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.46\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.6\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T19:23:53.735650Z\",\"id\":\"CVE-2025-39863\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10\",\"versionEndExcluding\":\"6.6.105\",\"matchCriteriaId\":\"D5818F4E-9CA3-4FE9-8A75-A6ACE2B108FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.46\",\"matchCriteriaId\":\"F7E2B332-E920-4CAC-B400-288602DB6F16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.6\",\"matchCriteriaId\":\"548F104C-0F08-438B-9C97-64C903F0C678\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:23:56+00:00",
      "cve": "CVE-2025-39863",
      "id": "CVE-2025-39863",
      "initial_release_date": "2025-09-19T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39863.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:44:56Z",
      "cve": "CVE-2025-39863",
      "id": "CVE-2025-39863",
      "initial_release_date": "2025-09-19T23:23:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "723",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "501",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39863",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39863.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39863\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:23:53.735650Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:23:48.533Z\"}}], \"cna\": {\"title\": \"wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"61730d4dfffc2cc9d3a49fad87633008105c18ba\", \"lessThan\": \"c75600e69e66a751cc046cd9c407b942f298d852\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"61730d4dfffc2cc9d3a49fad87633008105c18ba\", \"lessThan\": \"ae58f70bde0433f27ef4b388ab50634736607bf6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"61730d4dfffc2cc9d3a49fad87633008105c18ba\", \"lessThan\": \"f1150153c4e5940fe49ab51136343c5b4fe49d63\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"61730d4dfffc2cc9d3a49fad87633008105c18ba\", \"lessThan\": \"3e789f8475f6c857c88de5c5bf4b24b11a477dd7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"61730d4dfffc2cc9d3a49fad87633008105c18ba\", \"lessThan\": \"2f6fbc8e04ca1d1d5c560be694199f847229c625\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"61730d4dfffc2cc9d3a49fad87633008105c18ba\", \"lessThan\": \"9cb83d4be0b9b697eae93d321e0da999f9cdfcfc\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.105\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852\"}, {\"url\": \"https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6\"}, {\"url\": \"https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63\"}, {\"url\": \"https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7\"}, {\"url\": \"https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625\"}, {\"url\": \"https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\\n\\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\\nruns as timer handler, sets timer_on to false. This creates critical\\nrace conditions:\\n\\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\\nis executing, it may observe timer_on as false and skip the call to\\ntimer_shutdown_sync().\\n\\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\\nworker after the cancel_work_sync() has been executed, resulting in\\nuse-after-free bugs.\\n\\nThe use-after-free bugs occur in two distinct scenarios, depending on\\nthe timing of when the brcmf_btcoex_info struct is freed relative to\\nthe execution of its worker thread.\\n\\nScenario 1: Freed before the worker is scheduled\\n\\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\\nA race condition can occur when schedule_work(\u0026bt_local-\u003ework) is\\ncalled after the target memory has been freed. The sequence of events\\nis detailed below:\\n\\nCPU0                           | CPU1\\nbrcmf_btcoex_detach            | brcmf_btcoex_timerfunc\\n                               |   bt_local-\u003etimer_on = false;\\n  if (cfg-\u003ebtcoex-\u003etimer_on)   |\\n    ...                        |\\n  cancel_work_sync();          |\\n  ...                          |\\n  kfree(cfg-\u003ebtcoex); // FREE  |\\n                               |   schedule_work(\u0026bt_local-\u003ework); // USE\\n\\nScenario 2: Freed after the worker is scheduled\\n\\nThe brcmf_btcoex_info is freed after the worker has been scheduled\\nbut before or during its execution. In this case, statements within\\nthe brcmf_btcoex_handler() \\u2014 such as the container_of macro and\\nsubsequent dereferences of the brcmf_btcoex_info object will cause\\na use-after-free access. The following timeline illustrates this\\nscenario:\\n\\nCPU0                            | CPU1\\nbrcmf_btcoex_detach             | brcmf_btcoex_timerfunc\\n                                |   bt_local-\u003etimer_on = false;\\n  if (cfg-\u003ebtcoex-\u003etimer_on)    |\\n    ...                         |\\n  cancel_work_sync();           |\\n  ...                           |   schedule_work(); // Reschedule\\n                                |\\n  kfree(cfg-\u003ebtcoex); // FREE   |   brcmf_btcoex_handler() // Worker\\n  /*                            |     btci = container_of(....); // USE\\n   The kfree() above could      |     ...\\n   also occur at any point      |     btci-\u003e // USE\\n   during the worker\u0027s execution|\\n   */                           |\\n\\nTo resolve the race conditions, drop the conditional check and call\\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\\nregardless of its current state. Once stopped, the timer_on state is\\nthen set to false.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.210\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.167\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.105\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.46\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.6\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"3.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-07-30T05:58:08.210Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39863\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-30T05:58:08.210Z\", \"dateReserved\": \"2025-04-16T07:20:57.143Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-19T15:26:33.069Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.