PT-2025-38570 · Brcmfmac+5 · Brcmfmac+5
Published
2025-04-16
·
Updated
2026-05-07
·
CVE-2025-39863
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a use-after-free vulnerability within the brcmfmac module related to the handling of the brcmf btcoex info workqueue. Specifically, the
brcmf btcoex detach() function may fail to properly shut down the btcoex timer, leading to a race condition where the brcmf btcoex timerfunc() can reschedule the work after the memory has been freed. This can occur in two scenarios: when the brcmf btcoex info struct is freed before the worker is scheduled, or when it is freed after the worker has been scheduled but before or during its execution. The vulnerability arises from a missing call to timer shutdown sync() under certain conditions, allowing the timer to continue running and potentially accessing freed memory.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu
Brcmfmac