CVE-2025-40321 (GCVE-0-2025-40321)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2026-05-11 21:47
VLAI
Title
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface. However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash. [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000) Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver. Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion(). And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif. [Cc stable]
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < c863b9c7b4e9af0b7931cb791ec91971a50f1a25 (git)
Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < e1fc9afcce9139791260f962541282d47fbb508d (git)
Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < 55f60a72a178909ece4e32987e4c642ba57e1cf4 (git)
Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < c2b0f8d3e7358c33d90f0e62765d474f25f26a45 (git)
Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < 64e3175d1c8a3bea02032e7c9d1befd5f43786fa (git)
Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < a6eed58249e7d60f856900e682992300f770f64b (git)
Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a (git)
Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < 3776c685ebe5f43e9060af06872661de55e80b9a (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 5.4.302 , ≤ 5.4.* (semver)
Unaffected: 5.10.247 , ≤ 5.10.* (semver)
Unaffected: 5.15.197 , ≤ 5.15.* (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c863b9c7b4e9af0b7931cb791ec91971a50f1a25",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "e1fc9afcce9139791260f962541282d47fbb508d",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "55f60a72a178909ece4e32987e4c642ba57e1cf4",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "c2b0f8d3e7358c33d90f0e62765d474f25f26a45",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "64e3175d1c8a3bea02032e7c9d1befd5f43786fa",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "a6eed58249e7d60f856900e682992300f770f64b",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "3776c685ebe5f43e9060af06872661de55e80b9a",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.302",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode\n\nCurrently, whenever there is a need to transmit an Action frame,\nthe brcmfmac driver always uses the P2P vif to send the \"actframe\" IOVAR to\nfirmware. The P2P interfaces were available when wpa_supplicant is managing\nthe wlan interface.\n\nHowever, the P2P interfaces are not created/initialized when only hostapd\nis managing the wlan interface. And if hostapd receives an ANQP Query REQ\nAction frame even from an un-associated STA, the brcmfmac driver tries\nto use an uninitialized P2P vif pointer for sending the IOVAR to firmware.\nThis NULL pointer dereferencing triggers a driver crash.\n\n [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual\n address 0000000000000000\n [...]\n [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n [...]\n [ 1417.075653] Call trace:\n [ 1417.075662]  brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]\n [ 1417.075738]  brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]\n [ 1417.075810]  cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]\n [ 1417.076067]  nl80211_tx_mgmt+0x238/0x388 [cfg80211]\n [ 1417.076281]  genl_family_rcv_msg_doit+0xe0/0x158\n [ 1417.076302]  genl_rcv_msg+0x220/0x2a0\n [ 1417.076317]  netlink_rcv_skb+0x68/0x140\n [ 1417.076330]  genl_rcv+0x40/0x60\n [ 1417.076343]  netlink_unicast+0x330/0x3b8\n [ 1417.076357]  netlink_sendmsg+0x19c/0x3f8\n [ 1417.076370]  __sock_sendmsg+0x64/0xc0\n [ 1417.076391]  ____sys_sendmsg+0x268/0x2a0\n [ 1417.076408]  ___sys_sendmsg+0xb8/0x118\n [ 1417.076427]  __sys_sendmsg+0x90/0xf8\n [ 1417.076445]  __arm64_sys_sendmsg+0x2c/0x40\n [ 1417.076465]  invoke_syscall+0x50/0x120\n [ 1417.076486]  el0_svc_common.constprop.0+0x48/0xf0\n [ 1417.076506]  do_el0_svc+0x24/0x38\n [ 1417.076525]  el0_svc+0x30/0x100\n [ 1417.076548]  el0t_64_sync_handler+0x100/0x130\n [ 1417.076569]  el0t_64_sync+0x190/0x198\n [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)\n\nFix this, by always using the vif corresponding to the wdev on which the\nAction frame Transmission request was initiated by the userspace. This way,\neven if P2P vif is not available, the IOVAR is sent to firmware on AP vif\nand the ANQP Query RESP Action frame is transmitted without crashing the\ndriver.\n\nMove init_completion() for \"send_af_done\" from brcmf_p2p_create_p2pdev()\nto brcmf_p2p_attach(). Because the former function would not get executed\nwhen only hostapd is managing wlan interface, and it is not safe to do\nreinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior\ninit_completion().\n\nAnd in the brcmf_p2p_tx_action_frame() function, the condition check for\nP2P Presence response frame is not needed, since the wpa_supplicant is\nproperly sending the P2P Presense Response frame on the P2P-GO vif instead\nof the P2P-Device vif.\n\n[Cc stable]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:47:06.255Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c863b9c7b4e9af0b7931cb791ec91971a50f1a25"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1fc9afcce9139791260f962541282d47fbb508d"
        },
        {
          "url": "https://git.kernel.org/stable/c/55f60a72a178909ece4e32987e4c642ba57e1cf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2b0f8d3e7358c33d90f0e62765d474f25f26a45"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e3175d1c8a3bea02032e7c9d1befd5f43786fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6eed58249e7d60f856900e682992300f770f64b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3776c685ebe5f43e9060af06872661de55e80b9a"
        }
      ],
      "title": "wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40321",
    "datePublished": "2025-12-08T00:46:48.724Z",
    "dateReserved": "2025-04-16T07:20:57.186Z",
    "dateUpdated": "2026-05-11T21:47:06.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40321",
      "date": "2026-10-31",
      "epss": "0.00201",
      "percentile": "0.10051"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-16T14:38:58.000Z",
      "cve": "CVE-2025-40321",
      "id": "msrc_CVE-2025-40321",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40321.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
                  "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
                  "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c863b9c7b4e9af0b7931cb791ec91971a50f1a25",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e1fc9afcce9139791260f962541282d47fbb508d",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "55f60a72a178909ece4e32987e4c642ba57e1cf4",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c2b0f8d3e7358c33d90f0e62765d474f25f26a45",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "64e3175d1c8a3bea02032e7c9d1befd5f43786fa",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a6eed58249e7d60f856900e682992300f770f64b",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3776c685ebe5f43e9060af06872661de55e80b9a",
                    "status": "affected",
                    "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
                  "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
                  "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.9"
                  },
                  {
                    "lessThan": "3.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.302",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.247",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.197",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.159",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.117",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode\n\nCurrently, whenever there is a need to transmit an Action frame,\nthe brcmfmac driver always uses the P2P vif to send the \"actframe\" IOVAR to\nfirmware. The P2P interfaces were available when wpa_supplicant is managing\nthe wlan interface.\n\nHowever, the P2P interfaces are not created/initialized when only hostapd\nis managing the wlan interface. And if hostapd receives an ANQP Query REQ\nAction frame even from an un-associated STA, the brcmfmac driver tries\nto use an uninitialized P2P vif pointer for sending the IOVAR to firmware.\nThis NULL pointer dereferencing triggers a driver crash.\n\n [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual\n address 0000000000000000\n [...]\n [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n [...]\n [ 1417.075653] Call trace:\n [ 1417.075662]  brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]\n [ 1417.075738]  brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]\n [ 1417.075810]  cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]\n [ 1417.076067]  nl80211_tx_mgmt+0x238/0x388 [cfg80211]\n [ 1417.076281]  genl_family_rcv_msg_doit+0xe0/0x158\n [ 1417.076302]  genl_rcv_msg+0x220/0x2a0\n [ 1417.076317]  netlink_rcv_skb+0x68/0x140\n [ 1417.076330]  genl_rcv+0x40/0x60\n [ 1417.076343]  netlink_unicast+0x330/0x3b8\n [ 1417.076357]  netlink_sendmsg+0x19c/0x3f8\n [ 1417.076370]  __sock_sendmsg+0x64/0xc0\n [ 1417.076391]  ____sys_sendmsg+0x268/0x2a0\n [ 1417.076408]  ___sys_sendmsg+0xb8/0x118\n [ 1417.076427]  __sys_sendmsg+0x90/0xf8\n [ 1417.076445]  __arm64_sys_sendmsg+0x2c/0x40\n [ 1417.076465]  invoke_syscall+0x50/0x120\n [ 1417.076486]  el0_svc_common.constprop.0+0x48/0xf0\n [ 1417.076506]  do_el0_svc+0x24/0x38\n [ 1417.076525]  el0_svc+0x30/0x100\n [ 1417.076548]  el0t_64_sync_handler+0x100/0x130\n [ 1417.076569]  el0t_64_sync+0x190/0x198\n [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)\n\nFix this, by always using the vif corresponding to the wdev on which the\nAction frame Transmission request was initiated by the userspace. This way,\neven if P2P vif is not available, the IOVAR is sent to firmware on AP vif\nand the ANQP Query RESP Action frame is transmitted without crashing the\ndriver.\n\nMove init_completion() for \"send_af_done\" from brcmf_p2p_create_p2pdev()\nto brcmf_p2p_attach(). Because the former function would not get executed\nwhen only hostapd is managing wlan interface, and it is not safe to do\nreinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior\ninit_completion().\n\nAnd in the brcmf_p2p_tx_action_frame() function, the condition check for\nP2P Presence response frame is not needed, since the wpa_supplicant is\nproperly sending the P2P Presense Response frame on the P2P-GO vif instead\nof the P2P-Device vif.\n\n[Cc stable]"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: brcmfmac: soluciona un fallo al enviar tramas de acci\u00f3n en modo AP aut\u00f3nomo\n\nActualmente, siempre que hay necesidad de transmitir una trama de acci\u00f3n, el controlador brcmfmac siempre usa la vif P2P para enviar el IOVAR \u0027actframe\u0027 al firmware. Las interfaces P2P estaban disponibles cuando wpa_supplicant est\u00e1 gestionando la interfaz wlan.\n\nSin embargo, las interfaces P2P no se crean/inicializan cuando solo hostapd est\u00e1 gestionando la interfaz wlan. Y si hostapd recibe una trama de acci\u00f3n ANQP Query REQ incluso de una STA no asociada, el controlador brcmfmac intenta usar un puntero vif P2P no inicializado para enviar el IOVAR al firmware. Esta desreferenciaci\u00f3n de puntero NULL desencadena un fallo del controlador.\n\n [ 1417.074538] No se puede manejar la desreferenciaci\u00f3n de puntero NULL del kernel en la direcci\u00f3n virtual\n address 0000000000000000\n [...]\n [ 1417.075188] Nombre del hardware: Raspberry Pi 4 Model B Rev 1.5 (DT)\n [...]\n [ 1417.075653] Rastro de llamada:\n [ 1417.075662]  brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]\n [ 1417.075738]  brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]\n [ 1417.075810]  cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]\n [ 1417.076067]  nl80211_tx_mgmt+0x238/0x388 [cfg80211]\n [ 1417.076281]  genl_family_rcv_msg_doit+0xe0/0x158\n [ 1417.076302]  genl_rcv_msg+0x220/0x2a0\n [ 1417.076317]  netlink_rcv_skb+0x68/0x140\n [ 1417.076330]  genl_rcv+0x40/0x60\n [ 1417.076343]  netlink_unicast+0x330/0x3b8\n [ 1417.076357]  netlink_sendmsg+0x19c/0x3f8\n [ 1417.076370]  __sock_sendmsg+0x64/0xc0\n [ 1417.076391]  ____sys_sendmsg+0x268/0x2a0\n [ 1417.076408]  ___sys_sendmsg+0xb8/0x118\n [ 1417.076427]  __sys_sendmsg+0x90/0xf8\n [ 1417.076445]  __arm64_sys_sendmsg+0x2c/0x40\n [ 1417.076465]  invoke_syscall+0x50/0x120\n [ 1417.076486]  el0_svc_common.constprop.0+0x48/0xf0\n [ 1417.076506]  do_el0_svc+0x24/0x38\n [ 1417.076525]  el0_svc+0x30/0x100\n [ 1417.076548]  el0t_64_sync_handler+0x100/0x130\n [ 1417.076569]  el0t_64_sync+0x190/0x198\n [ 1417.076589] C\u00f3digo: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)\n\nSoluciona esto, usando siempre la vif correspondiente al wdev en la que la solicitud de transmisi\u00f3n de trama de acci\u00f3n fue iniciada por el espacio de usuario. De esta manera, incluso si la vif P2P no est\u00e1 disponible, el IOVAR se env\u00eda al firmware en la vif AP y la trama de acci\u00f3n ANQP Query RESP se transmite sin que el controlador falle.\n\nMover init_completion() para \u0027send_af_done\u0027 de brcmf_p2p_create_p2pdev() a brcmf_p2p_attach(). Porque la funci\u00f3n anterior no se ejecutar\u00eda cuando solo hostapd est\u00e1 gestionando la interfaz wlan, y no es seguro hacer reinit_completion() m\u00e1s tarde en brcmf_p2p_tx_action_frame(), sin ninguna init_completion() previa.\n\nY en la funci\u00f3n brcmf_p2p_tx_action_frame(), la comprobaci\u00f3n de condici\u00f3n para la trama de respuesta de presencia P2P no es necesaria, ya que wpa_supplicant est\u00e1 enviando correctamente la trama de respuesta de presencia P2P en la vif P2P-GO en lugar de la vif P2P-Device.\n\n[Cc estable]"
          }
        ],
        "id": "CVE-2025-40321",
        "lastModified": "2026-10-14T22:10:00.210",
        "metrics": {},
        "published": "2025-12-08T01:16:04.793",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3776c685ebe5f43e9060af06872661de55e80b9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/55f60a72a178909ece4e32987e4c642ba57e1cf4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/64e3175d1c8a3bea02032e7c9d1befd5f43786fa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a6eed58249e7d60f856900e682992300f770f64b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c2b0f8d3e7358c33d90f0e62765d474f25f26a45"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c863b9c7b4e9af0b7931cb791ec91971a50f1a25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e1fc9afcce9139791260f962541282d47fbb508d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T02:57:09+00:00",
      "cve": "CVE-2025-40321",
      "id": "CVE-2025-40321",
      "initial_release_date": "2025-12-08T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40321.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.