PT-2025-49450 · Linux+3 · Linux Kernel+3
Published
2025-12-08
·
Updated
2026-05-07
·
CVE-2025-40321
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel’s brcmfmac driver contains a flaw related to handling Action frames in standalone Access Point (AP) mode. Specifically, when hostapd manages the WLAN interface, the driver attempts to use an uninitialized P2P vif pointer when transmitting Action frames, leading to a NULL pointer dereference and driver crash. The issue arises because the driver always uses the P2P vif to send Action frames, even when P2P interfaces are not initialized. The fix involves ensuring the driver uses the vif corresponding to the wdev on which the Action frame transmission request was initiated. Additionally, the initialization of the
send af done completion is moved to brcmf p2p attach() and an unnecessary condition check in brcmf p2p tx action frame() is removed.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu