Skip to main content

Linux Kernel EUVDEUVD-2026-38961

| CVE-2026-53093 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-5hw3-x6vp-wc4h
Denial Of Service Linux Null Pointer Dereference Broadcom Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-privilege access
  2. Delivery
    Trigger brcmfmac driver probe or device re-enumeration
  3. Exploit
    brcmf_chip_add_core() returns ERR_PTR on chip initialization failure
  4. Execution
    Unchecked ERR_PTR dereferenced at up to five code sites
  5. Impact
    Kernel oops or panic causes system crash

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local, low-privilege (PR:L per CVSS vector) interactive access to a Linux system physically equipped with a Broadcom WiFi chipset that loads the brcmfmac kernel driver. The vulnerable code path is in the chip recognition/initialization routine, triggered during driver probe - which occurs at boot when the hardware is present, or when a USB/SDIO Broadcom WiFi adapter is inserted. An attacker with the ability to trigger driver reload or device re-enumeration (for example, via device hotplug) can exercise the error path. Remote exploitation is not possible (AV:L confirmed by CVSS vector). Systems without Broadcom WiFi hardware, cloud virtual machines, containers, and servers are not affected. The limiting factors are the combination of local access, low-privilege account, and physical presence of a Broadcom WiFi device using brcmfmac - all three must be satisfied.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (score 5.5) is well-calibrated for this vulnerability: local access with low privileges is required, impact is purely availability (kernel crash/DoS), and there is no scope change, confidentiality, or integrity impact. EPSS at 0.18% (7th percentile) is consistent with a kernel driver bug of this class - low exploitation probability due to the combination of local access requirements and hardware-specific preconditions. This vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, making this a low real-world priority. The attack surface is narrowly constrained to Linux systems physically equipped with a Broadcom WiFi chipset using the brcmfmac driver; cloud infrastructure, containers, and server environments are unaffected. The five Smatch-identified dereference sites all occur during chip initialization/recognition, meaning the error path is triggered during driver probe or device enumeration. For organizations with Broadcom WiFi-equipped endpoints (embedded systems, Raspberry Pi fleets, Chromebook-derived devices), this warrants normal patch cadence - not emergency response. No signal conflicts are present; CVSS, EPSS, and KEV absence are all mutually consistent.
Exploit ScenarioDerived

A local user with a standard low-privilege account on a Linux system equipped with a Broadcom WiFi adapter (e.g., a Raspberry Pi, embedded IoT device, or Chromebook-derived endpoint) induces a brcmfmac driver probe or reload event - for example, by triggering device re-enumeration or removing and re-inserting a USB Broadcom WiFi adapter. The chip recognition function attempts to add a core and receives an ERR_PTR from brcmf_chip_add_core(), which is immediately dereferenced without validation, causing a kernel panic and system crash. No public proof-of-concept has been identified, though the bug's static-analysis origin and straightforward trigger path make it mechanically reproducible on affected hardware.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 23, 2026

Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version: 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or mainline 7.1. Upstream stable fix commits are available at git.kernel.org/stable/c/ per the eight reference commits listed in this CVE. Ubuntu users should apply updates via standard package management referencing USN-8566-1, USN-8567-1, and USN-8568-1. As a compensating control on systems that cannot be immediately patched, blacklisting the brcmfmac kernel module by adding 'blacklist brcmfmac' to /etc/modprobe.d/brcmfmac.conf and running update-initramfs will prevent the driver from loading, fully eliminating the attack surface - at the cost of losing all Broadcom WiFi functionality on the affected hardware. This trade-off is acceptable only on systems where WiFi is non-essential or provided by alternative hardware. No other workarounds are available given the vulnerability is in the driver's core chip recognition path.

Affected VersionsENISA

Linux patch: 7.0.10
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <2e0e5a43ed126f896a4ad31ade66c90270601bae
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <d3f280be48f1c672cb10e8026c236d0cca60048a
Linux patch: 5.10.258
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <99ef547659178eef6d6ba4738a9d989ce90cf909
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af
Linux patch: 6.6.141
Linux patch: 7.1
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <334c68750eee84c2327db1d152be83ff5ad8e20b
Linux patch: 0
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <dd8592fc6007a451c3e4b9025de365e39de8178a
Linux patch: 6.1.175
Linux 3.15
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d
Linux cb7cf7be9eba76f3cd6258906074c72084570c84 <cbea71b4480394708f9a6e007a0385acfe5e1ec8
Linux patch: 6.18.33
Linux patch: 6.12.91
Linux patch: 5.15.209

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c within the Broadcom FullMAC (brcmfmac) wireless LAN driver. The root cause is CWE-476 (NULL Pointer Dereference) - specifically an unchecked error pointer: in Linux kernel convention, functions returning ERR_PTR encode failure as a pointer value in the upper address range rather than NULL. brcmf_chip_add_core() may return such an ERR_PTR on failure, but brcmf_chip_recognition() does not call IS_ERR() before dereferencing the returned pointer at five distinct locations (lines 1010, 1013, 1016, 1019, 1022). Dereferencing an ERR_PTR sentinel triggers a kernel oops or panic. The brcmfmac driver supports Broadcom/Cypress FullMAC 802.11 chipsets commonly found in Raspberry Pi devices, Chromebooks, embedded/IoT systems, and consumer hardware with Broadcom PCIe or SDIO WiFi adapters. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirms this spans multiple stable kernel branches from 3.15 onward.

Know when Broadcom gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local access required to trigger driver probe; low-privilege user sufficient; impact is kernel crash (availability only) with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 23, 2026 - 18:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Fix error pointer dereference

The function brcmf_chip_add_core() can return an error pointer and is not checked. Add checks for error pointer.

Detected by Smatch: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

[add missing wifi: prefix]

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Medium
common in embedded, IoT, Raspberry Pi, and Broadcom WiFi consumer Linux devices
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Broadcom

View all
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2018-1273 CRITICAL POC
9.8 Apr 11

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2022-2068 HIGH
7.3 Jun 21

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas
CVE-2016-8204 CRITICAL
9.8 Jan 14

A Directory Traversal vulnerability in FileReceiveServlet in the Brocade Network Advisor versions released prior to and

CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2020-1967 HIGH POC
7.5 Apr 21

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
CVE-2017-0561 CRITICAL POC
9.8 Apr 07

A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary
CVE-2017-9417 CRITICAL POC
9.8 Jun 04

Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn
CVE-2026-22719 HIGH
8.1 Feb 25

VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
CVE-2012-2619 HIGH POC
7.8 Nov 14

The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Moto

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53093 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373449 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/2e0e5a43ed126f896a4ad31ade66c90270601bae REF https://git.kernel.org/stable/c/334c68750eee84c2327db1d152be83ff5ad8e20b REF https://git.kernel.org/stable/c/99ef547659178eef6d6ba4738a9d989ce90cf909 REF https://git.kernel.org/stable/c/a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af REF https://git.kernel.org/stable/c/bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d REF https://git.kernel.org/stable/c/cbea71b4480394708f9a6e007a0385acfe5e1ec8 REF https://git.kernel.org/stable/c/d3f280be48f1c672cb10e8026c236d0cca60048a REF https://git.kernel.org/stable/c/dd8592fc6007a451c3e4b9025de365e39de8178a

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy