CVE-2026-43110
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. [add missing wifi prefix]
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description kernel: wifi: brcmfmac: validate bsscfg indices in IF events Red Hat statement brcmfmac IF event handling validates the firmware provided ifidx but still uses the raw bsscfgidx value as an index into the driver iflist array. A malformed firmware IF event with an out of range bsscfgidx can cause an out of bounds pointer read and may lead to an invalid pointer dereference or broader…
Description
kernel: wifi: brcmfmac: validate bsscfg indices in IF events
Red Hat statement
brcmfmac IF event handling validates the firmware provided ifidx but still uses the raw bsscfgidx value as an index into the driver iflist array. A malformed firmware IF event with an out of range bsscfgidx can cause an out of bounds pointer read and may lead to an invalid pointer dereference or broader memory corruption depending on how the resulting ifp is used. For the CVSS the PR:N is used in the paranoid score because a practical attacker model may involve adjacent Wi-Fi influence over FullMAC firmware events rather than a local privileged user on the host. The issue is not reachable over a normal routed IP network. It is adjacent network or device firmware mediated. Impact is at least denial of service through a kernel crash or Wi-Fi driver failure. In the paranoid case, the unchecked firmware controlled array index potentially could lead to possible confidentiality and integrity impact (but primarily only Availability impact).
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected |
| Red Hat Enterprise Linux 6 | kernel | Not affected |
| Red Hat Enterprise Linux 7 | kernel | Affected |
| Red Hat Enterprise Linux 7 | kernel-rt | Affected |
| Red Hat Enterprise Linux 8 | kernel | Affected |
| Red Hat Enterprise Linux 8 | kernel-rt | Affected |
| Red Hat Enterprise Linux 9 | kernel | Affected |
| Red Hat Enterprise Linux 9 | kernel-rt | Affected |
Affected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat Enterprise Linux 10 | Affected |
| redhat | Red Hat Enterprise Linux 6 | Not affected |
| redhat | Red Hat Enterprise Linux 7 | Affected |
| redhat | Red Hat Enterprise Linux 7 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Affected |
| redhat | Red Hat Enterprise Linux 8 | Affected |
| redhat | Red Hat Enterprise Linux 9 | Affected |
| redhat | Red Hat Enterprise Linux 9 | Affected |
OS impact
Linux kernel Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 7.0 | Affected | — |
| — | Affected | 6.6.136 |
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
Debian Mixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 6.12.85-1 |
| sid | Fixed | 6.19.14-1 |
| forky | Fixed | 6.19.14-1 |
| bullseye | Affected | — |
| bookworm | Affected | — |
Red Hat Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | — |
References
- https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d
- https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d
- https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6
- https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e
- https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb
- https://www.suse.com/security/cve/CVE-2026-43110.html
- https://security-tracker.debian.org/tracker/CVE-2026-43110
- https://access.redhat.com/errata/RHSA-2026:21556
- https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734
- https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c
- https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.