{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43110", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.986Z", "datePublished": "2026-05-06T07:40:37.250Z", "dateUpdated": "2026-08-05T12:25:57.498Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:57.498Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: validate bsscfg indices in IF events\n\nbrcmf_fweh_handle_if_event() validates the firmware-provided interface\nindex before it touches drvr->iflist[], but it still uses the raw\nbsscfgidx field as an array index without a matching range check.\n\nReject IF events whose bsscfg index does not fit in drvr->iflist[]\nbefore indexing the interface array.\n\n[add missing wifi prefix]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The vulnerable brcmfmac firmware-event path is reachable from WiFi-adjacent attack scenarios involving crafted Broadcom event frames or malicious event injection through the wireless device path. It does not require routable IP network access, but does require proximity to the affected WiFi interface.\nAC:L - Once the event path is reachable, the attacker-controlled IF-event payload directly supplies the unchecked bsscfgidx and no race or hard-to-satisfy heap condition is required to trigger the out-of-bounds access. The higher-severity choice is appropriate because the malformed index is consumed deterministically.\nPR:N - In the highest reasonable WiFi-adjacent scenario, the attacker sends crafted wireless traffic/event data without any local account or administrative privilege on the victim. Local nl80211 interface creation has admin gating, but that is not the highest-severity reachable scenario for this driver class.\nUI:N - No victim action is required once the affected wireless interface is active in a reachable deployment. The vulnerable worker processes queued firmware events asynchronously without prompting the user.\nS:U - The corruption occurs within the host kernel driver and impacts the same kernel security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The unchecked bsscfgidx indexes beyond drvr->iflist[], and subsequent paths can treat adjacent kernel memory as interface pointers. As kernel memory corruption, this can reasonably be leveraged for high-impact information disclosure.\nI:H - The IF_ADD path can write a newly allocated brcmf_if pointer through an out-of-bounds drvr->iflist[] slot, corrupting adjacent kernel state. This is an out-of-bounds write primitive and is scored as high integrity impact.\nA:H - Malformed indices can cause invalid pointer dereferences, bogus interface removal/reset operations, or broader kernel memory corruption. These conditions can crash or destabilize the kernel, so availability impact is high." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c" ], "versions": [ { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "b329fbcf075949a038045d8e9b86ae3d5bbd8a54", "status": "affected", "versionType": "git" }, { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734", "status": "affected", "versionType": "git" }, { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "9c81bcc2c695e0082012a2a3d36a0eefaa51579c", "status": "affected", "versionType": "git" }, { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "3ec7437e9d11374105c2c4e47ae671537729d7e6", "status": "affected", "versionType": "git" }, { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "9fca68c2512a362cad258e4df12a307bb2ee4b8e", "status": "affected", "versionType": "git" }, { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "1ae1e1caa428844e481231f6dbe9b4f475f1d52d", "status": "affected", "versionType": "git" }, { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "b427c2b05222db36d32ee141609de6128e9091bb", "status": "affected", "versionType": "git" }, { "version": "2880b86859967af710c72f7d34fb421a86a71e22", "lessThan": "304950a467d83678bd0b0f46331882e2ac23b12d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c" ], "versions": [ { "version": "3.9", "status": "affected" }, { "version": "0", "lessThan": "3.9", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.10.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.6.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.12.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.18.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.19.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54" }, { "url": "https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734" }, { "url": "https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c" }, { "url": "https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6" }, { "url": "https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e" }, { "url": "https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d" }, { "url": "https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb" }, { "url": "https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d" } ], "title": "wifi: brcmfmac: validate bsscfg indices in IF events", "x_generator": { "engine": "bippy-1.2.0" } } } }