PT-2026-122038
CVE-2026-99061
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix P2P device removal race in brcmf detach()
When the driver is removed while the user space process that created
the P2P device (e.g. wpa supplicant) is still exiting, the P2P device
interface is removed twice and the kernel crashes.
The two paths are:
-
wpa supplicant, on exit, sends NL80211 CMD DEL INTERFACE for the P2P device. nl80211 del interface() holds RTNL and the wiphy mutex and calls brcmf p2p del vif(), which disables discovery and waits up to 1.5 s for BRCMF E IF DEL. Then it calls brcmf remove interface(), which unregisters the wdev and frees the vif and the ifp.
-
brcmf detach() sets the bus down, so BRCMF E IF DEL never arrives, and calls brcmf remove interface(ifp, false) for the same ifp. brcmf p2p ifp removed() reads ifp->vif and then blocks on rtnl lock(). When brcmf p2p del vif() releases RTNL, it calls cfg80211 unregister wdev() on the wdev that was already unregistered and freed.
The second list del rcu() of wdev->list faults on LIST POISON2:
brcmfmac: brcmf p2p del vif delete P2P vif
brcmfmac: brcmf p2p deinit discovery enter
brcmfmac: brcmf p2p del vif P2P: GO NEG PHASE status cleared
brcmfmac: brcmf detach Enter
brcmfmac: brcmf bus change state 1 -> 0
brcmfmac: brcmf remove interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf del if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf p2p ifp removed P2P: device interface removed
[1.5 s later, brcmf p2p del vif() timed out]
brcmfmac: brcmf remove interface Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf del if Enter, bsscfgidx=1, ifidx=0
brcmfmac: brcmf p2p ifp removed P2P: device interface removed
Unable to handle kernel paging request at virtual address dead000000000122
Internal error: Oops: 96000044 [#1] PREEMPT RT SMP
pc : cfg80211 unregister wdev+0x6c/0x264 [cfg80211]
Call trace:
cfg80211 unregister wdev+0x6c/0x264 [cfg80211]
cfg80211 unregister wdev+0x10/0x1c [cfg80211]
brcmf p2p ifp removed+0x84/0xb0 [brcmfmac]
brcmf remove interface+0x1f4/0x254 [brcmfmac]
brcmf detach+0x88/0x180 [brcmfmac]
brcmf sdio remove+0x90/0x7b0 [brcmfmac]
brcmf sdiod remove+0x20/0xa0 [brcmfmac]
brcmf ops sdio remove+0xbc/0x12c [brcmfmac]
sdio bus remove+0x38/0x144
device release driver internal+0x1e8/0x2c0
device release driver+0x14/0x20
brcmf sdio bus remove+0x2c/0x40 [brcmfmac]
brcmf fwvid unregister vendor+0xd8/0x170 [brcmfmac]
exit compat+0x18/0x418 [brcmfmac cyw]
arm64 sys delete module+0x1ac/0x244
The log was taken with debug=0x406 on an i.MX 8M Plus board with a
CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of
brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same
in mainline.
To reproduce:
-
Start wpa supplicant on wlan0 and let it associate. It creates the P2P device (iw dev shows "type P2P-device").
-
Stop wpa supplicant and remove the driver without waiting for wpa supplicant to exit:kill $(pidof wpa supplicant) rmmod brcmfmac cyw brcmfmac
The crash is reproducible on that board.
For the interface without a netdev (the P2P device), take RTNL and the
wiphy mutex in brcmf detach() before reading iflist, and remove it with
locked=true. If brcmf p2p del vif() runs first, brcmf detach() finds the
slot empty. If brcmf detach() runs first, nl80211 does not find the wdev
any more. The interfaces with a netdev are removed as before, because
brcmf del if() takes RTNL on its own for the primary interface.
Found an issue in the description? Have something to add? Feel free to write us 👾