CVE-2026-72003

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. A remote attacker, by sending a specially crafted short authentication frame during the SAE (Simultaneous Authentication of Equals) authentication exchange, could trigger a heap overflow. This vulnerability allows for potential arbitrary code execution or a denial of service (DoS) on the affected system.

This vulnerability is rated as Important severity because an adjacent untrusted access point can trigger memory corruption remotely across the wireless network without prior privileges, risking kernel crashes or code execution. Standard Red Hat Enterprise Linux server deployments do not enable or configure wireless interfaces by default, substantially mitigating practical exposure. The risk is confined to configurations operating compatible Broadcom or Cypress wireless devices connected to networks using Simultaneous Authentication of Equals.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the brcmfmac kernel module from being loaded:

1. Create a configuration file to prevent loading the module:

echo "install brcmfmac /bin/true" >> /etc/modprobe.d/disable-brcmfmac.conf

2. If the module is currently loaded, unload it:

modprobe -r brcmfmac

If the module is actively in use and cannot be unloaded dynamically, a system reboot is required for the change to take effect.

Caveats: Disabling this module will disable wireless network connectivity for any devices that rely on the Broadcom FullMAC (brcmfmac) wireless driver.