Skip to main content

Linux Kernel EUVDEUVD-2026-38961

| CVE-2026-53093 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-5hw3-x6vp-wc4h
Denial Of Service Broadcom Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access required to trigger driver probe; low-privilege user sufficient; impact is kernel crash (availability only) with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 23, 2026 - 18:40 vuln.today
CVSS changed
Jul 23, 2026 - 18:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Fix error pointer dereference

The function brcmf_chip_add_core() can return an error pointer and is not checked. Add checks for error pointer.

Detected by Smatch: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR()

[add missing wifi: prefix]

AnalysisAI

Error pointer dereference in the Linux kernel's brcmfmac Broadcom WiFi driver allows a local low-privilege attacker to crash the kernel via a NULL pointer dereference, resulting in denial of service. The function brcmf_chip_add_core() in brcmf_chip_recognition() can return an ERR_PTR sentinel value that is never validated before being dereferenced at five separate code sites (lines 1010-1022 of chip.c), as identified by Smatch static analysis. No public exploit or active exploitation has been identified; EPSS sits at 0.18% (7th percentile), consistent with a low-priority local DoS affecting only systems with Broadcom WiFi hardware.

Technical ContextAI

The vulnerability resides in drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c within the Broadcom FullMAC (brcmfmac) wireless LAN driver. The root cause is CWE-476 (NULL Pointer Dereference) - specifically an unchecked error pointer: in Linux kernel convention, functions returning ERR_PTR encode failure as a pointer value in the upper address range rather than NULL. brcmf_chip_add_core() may return such an ERR_PTR on failure, but brcmf_chip_recognition() does not call IS_ERR() before dereferencing the returned pointer at five distinct locations (lines 1010, 1013, 1016, 1019, 1022). Dereferencing an ERR_PTR sentinel triggers a kernel oops or panic. The brcmfmac driver supports Broadcom/Cypress FullMAC 802.11 chipsets commonly found in Raspberry Pi devices, Chromebooks, embedded/IoT systems, and consumer hardware with Broadcom PCIe or SDIO WiFi adapters. CPE data (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*) confirms this spans multiple stable kernel branches from 3.15 onward.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version: 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or mainline 7.1. Upstream stable fix commits are available at git.kernel.org/stable/c/ per the eight reference commits listed in this CVE. Ubuntu users should apply updates via standard package management referencing USN-8566-1, USN-8567-1, and USN-8568-1. As a compensating control on systems that cannot be immediately patched, blacklisting the brcmfmac kernel module by adding 'blacklist brcmfmac' to /etc/modprobe.d/brcmfmac.conf and running update-initramfs will prevent the driver from loading, fully eliminating the attack surface - at the cost of losing all Broadcom WiFi functionality on the affected hardware. This trade-off is acceptable only on systems where WiFi is non-essential or provided by alternative hardware. No other workarounds are available given the vulnerability is in the driver's core chip recognition path.

More in Broadcom

View all
CVE-2016-0801 CRITICAL POC
9.8 Feb 07

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01

CVE-2017-0561 CRITICAL POC
9.8 Apr 07

A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary
CVE-2017-9417 CRITICAL POC
9.8 Jun 04

Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn
CVE-2026-22719 HIGH
8.1 Feb 25

VMware Aria Operations contains a command injection vulnerability (CVE-2026-22719, CVSS 8.1) that allows unauthenticated
CVE-2017-11120 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
CVE-2012-2619 HIGH POC
7.8 Nov 14

The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Moto
CVE-2014-2046 CRITICAL POC
9.7 May 14

cgi-bin/rpcBridge in the web interface 1.1 on Broadcom Ltd PIPA C211 rev2 does not properly restrict access, which allow
CVE-2013-4659 CRITICAL POC
9.8 Mar 14

Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. R
CVE-2017-11121 CRITICAL POC
9.8 Sep 28

On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transi
CVE-2017-6957 HIGH POC
8.1 Mar 27

Stack-based buffer overflow in the firmware in Broadcom Wi-Fi HardMAC SoC chips, when the firmware supports CCKM Fast an
CVE-2021-42772 CRITICAL POC
9.8 Nov 03

Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly
CVE-2023-31096 HIGH POC
7.8 Oct 10

An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). Rated

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

EUVD-2026-38961 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy