SB20260816527 - Heap-based buffer overflow in Linux kernel brcmfmac cyw driver

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-72003)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in brcmf_notify_auth_frame_rx() in the brcmfmac cyw wireless driver when processing a short authentication frame during the external SAE authentication exchange. A remote attacker can send a specially crafted short authentication frame from a malicious access point to cause a denial of service or execute arbitrary code.

The issue can be triggered by a malicious or malfunctioning access point during the external SAE authentication exchange.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/185bb156c427d0f865d344a6d0eaa02c6d05cc57
• https://git.kernel.org/stable/c/240c8d2c717b3f8153e7e877b22a82518d78dbdc
• https://git.kernel.org/stable/c/55b26abb1fa1ec406b3ad11b43c49c7624257565