Severity by source
Local SPI hardware required (AV:L, AC:H); driver-level access needed (PR:L); impact is primarily kernel crash (A:H) with minor memory corruption risk (I:L); no confidentiality impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
1DescriptionCVE.org
[cyw_spi_tx SPI alignment padding indexes uint32_t* buffer with byte offset]
AnalysisAI
Memory misalignment in the Linux kernel's Broadcom/Cypress WiFi SPI driver (brcmfmac) allows incorrect buffer indexing in the cyw_spi_tx function. The function indexes a uint32_t* buffer using a raw byte offset, causing pointer arithmetic to advance by word-sized (4-byte) units when byte-sized steps were intended. Depending on how this misalignment manifests at runtime, consequences may range from corrupted SPI transmit data to an out-of-bounds memory access within the kernel, potentially causing a kernel panic or memory corruption on affected devices. No public exploit or CISA KEV listing is identified at time of analysis.
Technical ContextAI
The cyw_spi_tx function resides in the Linux kernel's brcmfmac driver, which supports Broadcom and Cypress (CYW-series) FullMAC WiFi chips connected to the host via the SPI (Serial Peripheral Interface) bus. SPI is an internal, synchronous serial protocol between the host CPU and the WiFi chip; it is not directly externally addressable. The bug is a pointer/index type mismatch: alignment padding logic computes a byte offset but then uses that offset to index into a uint32_t* (4-byte-aligned) buffer. In C, pointer arithmetic on uint32_t* advances by sizeof(uint32_t) = 4 bytes per unit, so using a byte offset directly causes the function to read or write memory 3 bytes beyond the intended word boundary per offset unit - a classic CWE-704 (Incorrect Type Conversion or Cast) or CWE-823 (Use of Out-of-range Pointer Offset) pattern. The CWE is not formally assigned in the available data. Affected CPE strings are not provided; affected hardware is any Linux system equipped with a CYW-series SPI WiFi module (common in embedded, IoT, and Raspberry Pi-class devices).
Affected ProductsAI
The vulnerability affects the Linux kernel brcmfmac driver, specifically the cyw_spi_tx function in the SPI transport layer. Affected systems are those running a vulnerable Linux kernel version with a Broadcom or Cypress CYW-series WiFi chip connected via SPI (e.g., CYW43xxx family modules common on Raspberry Pi and similar SBCs). Exact affected kernel version ranges and fixed kernel version are not specified in the available data. The Ubuntu vendor report implies affected Ubuntu releases track the upstream kernel; users should consult Ubuntu Security Notices (USN) for version-specific guidance. No CPE strings were provided.
RemediationAI
The primary remediation is to apply the upstream Linux kernel patch addressing the cyw_spi_tx byte-offset indexing error once it is merged and backported to stable/LTS branches. Ubuntu users should monitor Ubuntu Security Notices at ubuntu.com/security/notices for a USN advisory covering this CVE and apply the kernel update via standard package management (apt update && apt full-upgrade). No exact fixed kernel version is confirmed in the available data - do not apply a speculative version. If immediate patching is not possible and the device is an embedded system with network exposure, a compensating control is to restrict network access to the device at the perimeter, reducing the exposure of any secondary WiFi-triggered code path; note this does not eliminate the local attack surface. Disabling the brcmfmac module (modprobe -r brcmfmac) would prevent exploitation but also disables WiFi entirely, which is only viable if an alternative connectivity path exists. No vendor advisory URL was provided in the reference data.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today