CVE-2026-99061
kernel: wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 23, 2026
Updated · October 27, 2026
Description
A flaw was found in the Linux kernel's brcmfmac wireless driver. This vulnerability can lead to a Denial of Service (DoS) caused by a race condition during the removal of peer-to-peer (P2P) device interfaces. A local user could trigger this flaw by unloading the driver while the user space process managing the interface is shutting down, causing resources to be freed twice and resulting in a kernel crash.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.1CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-825 · Expired Pointer Dereference