Vulnerability-Lookup

GHSA-24VC-PXRH-RPJV

Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-06-01 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: validate bsscfg indices in IF events

brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check.

Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array.

[add missing wifi prefix]

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-43110"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T10:16:24Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: validate bsscfg indices in IF events\n\nbrcmf_fweh_handle_if_event() validates the firmware-provided interface\nindex before it touches drvr-\u003eiflist[], but it still uses the raw\nbsscfgidx field as an array index without a matching range check.\n\nReject IF events whose bsscfg index does not fit in drvr-\u003eiflist[]\nbefore indexing the interface array.\n\n[add missing wifi prefix]",
  "id": "GHSA-24vc-pxrh-rpjv",
  "modified": "2026-06-01T18:31:30Z",
  "published": "2026-05-06T12:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43110"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-43110 (GCVE-0-2026-43110)

Vulnerability from cvelistv5 – Published: 2026-05-06 07:40 – Updated: 2026-08-05 12:25

Title

wifi: brcmfmac: validate bsscfg indices in IF events

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. [add missing wifi prefix]

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/b329fbcf075949a03…
https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5e…
https://git.kernel.org/stable/c/9c81bcc2c695e0082…
https://git.kernel.org/stable/c/3ec7437e9d1137410…
https://git.kernel.org/stable/c/9fca68c2512a362ca…
https://git.kernel.org/stable/c/1ae1e1caa428844e4…
https://git.kernel.org/stable/c/b427c2b05222db36d…
https://git.kernel.org/stable/c/304950a467d83678b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < b329fbcf075949a038045d8e9b86ae3d5bbd8a54 (git) Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < 2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734 (git) Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < 9c81bcc2c695e0082012a2a3d36a0eefaa51579c (git) Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < 3ec7437e9d11374105c2c4e47ae671537729d7e6 (git) Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < 9fca68c2512a362cad258e4df12a307bb2ee4b8e (git) Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < 1ae1e1caa428844e481231f6dbe9b4f475f1d52d (git) Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < b427c2b05222db36d32ee141609de6128e9091bb (git) Affected: 2880b86859967af710c72f7d34fb421a86a71e22 , < 304950a467d83678bd0b0f46331882e2ac23b12d (git)
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b329fbcf075949a038045d8e9b86ae3d5bbd8a54",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            },
            {
              "lessThan": "2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            },
            {
              "lessThan": "9c81bcc2c695e0082012a2a3d36a0eefaa51579c",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            },
            {
              "lessThan": "3ec7437e9d11374105c2c4e47ae671537729d7e6",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            },
            {
              "lessThan": "9fca68c2512a362cad258e4df12a307bb2ee4b8e",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            },
            {
              "lessThan": "1ae1e1caa428844e481231f6dbe9b4f475f1d52d",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            },
            {
              "lessThan": "b427c2b05222db36d32ee141609de6128e9091bb",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            },
            {
              "lessThan": "304950a467d83678bd0b0f46331882e2ac23b12d",
              "status": "affected",
              "version": "2880b86859967af710c72f7d34fb421a86a71e22",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: validate bsscfg indices in IF events\n\nbrcmf_fweh_handle_if_event() validates the firmware-provided interface\nindex before it touches drvr-\u003eiflist[], but it still uses the raw\nbsscfgidx field as an array index without a matching range check.\n\nReject IF events whose bsscfg index does not fit in drvr-\u003eiflist[]\nbefore indexing the interface array.\n\n[add missing wifi prefix]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable brcmfmac firmware-event path is reachable from WiFi-adjacent attack scenarios involving crafted Broadcom event frames or malicious event injection through the wireless device path. It does not require routable IP network access, but does require proximity to the affected WiFi interface.\nAC:L - Once the event path is reachable, the attacker-controlled IF-event payload directly supplies the unchecked bsscfgidx and no race or hard-to-satisfy heap condition is required to trigger the out-of-bounds access. The higher-severity choice is appropriate because the malformed index is consumed deterministically.\nPR:N - In the highest reasonable WiFi-adjacent scenario, the attacker sends crafted wireless traffic/event data without any local account or administrative privilege on the victim. Local nl80211 interface creation has admin gating, but that is not the highest-severity reachable scenario for this driver class.\nUI:N - No victim action is required once the affected wireless interface is active in a reachable deployment. The vulnerable worker processes queued firmware events asynchronously without prompting the user.\nS:U - The corruption occurs within the host kernel driver and impacts the same kernel security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The unchecked bsscfgidx indexes beyond drvr-\u003eiflist[], and subsequent paths can treat adjacent kernel memory as interface pointers. As kernel memory corruption, this can reasonably be leveraged for high-impact information disclosure.\nI:H - The IF_ADD path can write a newly allocated brcmf_if pointer through an out-of-bounds drvr-\u003eiflist[] slot, corrupting adjacent kernel state. This is an out-of-bounds write primitive and is scored as high integrity impact.\nA:H - Malformed indices can cause invalid pointer dereferences, bogus interface removal/reset operations, or broader kernel memory corruption. These conditions can crash or destabilize the kernel, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:57.498Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d"
        }
      ],
      "title": "wifi: brcmfmac: validate bsscfg indices in IF events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43110",
    "datePublished": "2026-05-06T07:40:37.250Z",
    "dateReserved": "2026-05-01T14:12:55.986Z",
    "dateUpdated": "2026-08-05T12:25:57.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.