CVE-2026-64586

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. When a device using this driver is removed, a pending or running bus_reset callback can attempt to access memory that has already been freed. This use-after-free vulnerability can lead to system instability or a denial of service (DoS), causing the system to crash.

A use-after-free can occur in brcmfmac because the shared bus_reset work item may remain pending or running while device removal frees the drvr object through brcmf_free and wiphy_free. The bus_reset callback recovers drvr with container_of and dereferences it, so a reset armed by brcmf_fw_crashed or debugfs reset can outlive the object lifetime during PCIe, SDIO, or USB removal. For the CVSS the PR:L is used in the paranoid score because some deployments may expose reset, hotplug, suspend, or firmware crash triggering to a local service account, container root, or otherwise reduced local privilege rather than only full administrator control. The issue is not directly network reachable as AV:N from the patch context. A wireless adjacent contribution through a firmware crash producer is possible only as a device specific hypothesis and should not be treated as the primary vector without more evidence. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.