CVE-2026-64586

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the brcmfmac WiFi driver where the removal path frees the drvr structure without draining pending work. Specifically, the brcmf fw crashed() function and the debugfs "reset" entry schedule drvr->bus reset, which dereferences drvr. If a bus reset callback is pending or running during device removal, it can outlive the drvr structure, leading to a use-after-free scenario. The issue affects PCIe, SDIO, and USB paths. Additionally, brcmf fw crashed() could dereference a NULL drvr if triggered before brcmf attach() completes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.