CVE-2025-40321

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel’s brcmfmac driver contains a flaw related to handling Action frames in standalone Access Point (AP) mode. Specifically, when hostapd manages the WLAN interface, the driver attempts to use an uninitialized P2P vif pointer when transmitting Action frames, leading to a NULL pointer dereference and driver crash. The issue arises because the driver always uses the P2P vif to send Action frames, even when P2P interfaces are not initialized. The fix involves ensuring the driver uses the vif corresponding to the wdev on which the Action frame transmission request was initiated. Additionally, the initialization of the send af done completion is moved to brcmf p2p attach() and an unnecessary condition check in brcmf p2p tx action frame() is removed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.