Vulnerability-Lookup

FKIE_CVE-2025-40321

Vulnerability from fkie_nvd - Published: 2025-12-08 01:16 - Updated: 2026-10-14 22:10

Severity

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Currently, whenever there is a need to transmit an Action frame, the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to firmware. The P2P interfaces were available when wpa_supplicant is managing the wlan interface. However, the P2P interfaces are not created/initialized when only hostapd is managing the wlan interface. And if hostapd receives an ANQP Query REQ Action frame even from an un-associated STA, the brcmfmac driver tries to use an uninitialized P2P vif pointer for sending the IOVAR to firmware. This NULL pointer dereferencing triggers a driver crash. [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [...] [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT) [...] [ 1417.075653] Call trace: [ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac] [ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac] [ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211] [ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211] [ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158 [ 1417.076302] genl_rcv_msg+0x220/0x2a0 [ 1417.076317] netlink_rcv_skb+0x68/0x140 [ 1417.076330] genl_rcv+0x40/0x60 [ 1417.076343] netlink_unicast+0x330/0x3b8 [ 1417.076357] netlink_sendmsg+0x19c/0x3f8 [ 1417.076370] __sock_sendmsg+0x64/0xc0 [ 1417.076391] ____sys_sendmsg+0x268/0x2a0 [ 1417.076408] ___sys_sendmsg+0xb8/0x118 [ 1417.076427] __sys_sendmsg+0x90/0xf8 [ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40 [ 1417.076465] invoke_syscall+0x50/0x120 [ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0 [ 1417.076506] do_el0_svc+0x24/0x38 [ 1417.076525] el0_svc+0x30/0x100 [ 1417.076548] el0t_64_sync_handler+0x100/0x130 [ 1417.076569] el0t_64_sync+0x190/0x198 [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000) Fix this, by always using the vif corresponding to the wdev on which the Action frame Transmission request was initiated by the userspace. This way, even if P2P vif is not available, the IOVAR is sent to firmware on AP vif and the ANQP Query RESP Action frame is transmitted without crashing the driver. Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev() to brcmf_p2p_attach(). Because the former function would not get executed when only hostapd is managing wlan interface, and it is not safe to do reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior init_completion(). And in the brcmf_p2p_tx_action_frame() function, the condition check for P2P Presence response frame is not needed, since the wpa_supplicant is properly sending the P2P Presense Response frame on the P2P-GO vif instead of the P2P-Device vif. [Cc stable]

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3776c685ebe5f43e9060af06872661de55e80b9a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/55f60a72a178909ece4e32987e4c642ba57e1cf4
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/64e3175d1c8a3bea02032e7c9d1befd5f43786fa
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a6eed58249e7d60f856900e682992300f770f64b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c2b0f8d3e7358c33d90f0e62765d474f25f26a45
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c863b9c7b4e9af0b7931cb791ec91971a50f1a25
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e1fc9afcce9139791260f962541282d47fbb508d

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c863b9c7b4e9af0b7931cb791ec91971a50f1a25",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "e1fc9afcce9139791260f962541282d47fbb508d",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "55f60a72a178909ece4e32987e4c642ba57e1cf4",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "c2b0f8d3e7358c33d90f0e62765d474f25f26a45",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "64e3175d1c8a3bea02032e7c9d1befd5f43786fa",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "a6eed58249e7d60f856900e682992300f770f64b",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "3776c685ebe5f43e9060af06872661de55e80b9a",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode\n\nCurrently, whenever there is a need to transmit an Action frame,\nthe brcmfmac driver always uses the P2P vif to send the \"actframe\" IOVAR to\nfirmware. The P2P interfaces were available when wpa_supplicant is managing\nthe wlan interface.\n\nHowever, the P2P interfaces are not created/initialized when only hostapd\nis managing the wlan interface. And if hostapd receives an ANQP Query REQ\nAction frame even from an un-associated STA, the brcmfmac driver tries\nto use an uninitialized P2P vif pointer for sending the IOVAR to firmware.\nThis NULL pointer dereferencing triggers a driver crash.\n\n [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual\n address 0000000000000000\n [...]\n [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n [...]\n [ 1417.075653] Call trace:\n [ 1417.075662]  brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]\n [ 1417.075738]  brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]\n [ 1417.075810]  cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]\n [ 1417.076067]  nl80211_tx_mgmt+0x238/0x388 [cfg80211]\n [ 1417.076281]  genl_family_rcv_msg_doit+0xe0/0x158\n [ 1417.076302]  genl_rcv_msg+0x220/0x2a0\n [ 1417.076317]  netlink_rcv_skb+0x68/0x140\n [ 1417.076330]  genl_rcv+0x40/0x60\n [ 1417.076343]  netlink_unicast+0x330/0x3b8\n [ 1417.076357]  netlink_sendmsg+0x19c/0x3f8\n [ 1417.076370]  __sock_sendmsg+0x64/0xc0\n [ 1417.076391]  ____sys_sendmsg+0x268/0x2a0\n [ 1417.076408]  ___sys_sendmsg+0xb8/0x118\n [ 1417.076427]  __sys_sendmsg+0x90/0xf8\n [ 1417.076445]  __arm64_sys_sendmsg+0x2c/0x40\n [ 1417.076465]  invoke_syscall+0x50/0x120\n [ 1417.076486]  el0_svc_common.constprop.0+0x48/0xf0\n [ 1417.076506]  do_el0_svc+0x24/0x38\n [ 1417.076525]  el0_svc+0x30/0x100\n [ 1417.076548]  el0t_64_sync_handler+0x100/0x130\n [ 1417.076569]  el0t_64_sync+0x190/0x198\n [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)\n\nFix this, by always using the vif corresponding to the wdev on which the\nAction frame Transmission request was initiated by the userspace. This way,\neven if P2P vif is not available, the IOVAR is sent to firmware on AP vif\nand the ANQP Query RESP Action frame is transmitted without crashing the\ndriver.\n\nMove init_completion() for \"send_af_done\" from brcmf_p2p_create_p2pdev()\nto brcmf_p2p_attach(). Because the former function would not get executed\nwhen only hostapd is managing wlan interface, and it is not safe to do\nreinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior\ninit_completion().\n\nAnd in the brcmf_p2p_tx_action_frame() function, the condition check for\nP2P Presence response frame is not needed, since the wpa_supplicant is\nproperly sending the P2P Presense Response frame on the P2P-GO vif instead\nof the P2P-Device vif.\n\n[Cc stable]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: brcmfmac: soluciona un fallo al enviar tramas de acci\u00f3n en modo AP aut\u00f3nomo\n\nActualmente, siempre que hay necesidad de transmitir una trama de acci\u00f3n, el controlador brcmfmac siempre usa la vif P2P para enviar el IOVAR \u0027actframe\u0027 al firmware. Las interfaces P2P estaban disponibles cuando wpa_supplicant est\u00e1 gestionando la interfaz wlan.\n\nSin embargo, las interfaces P2P no se crean/inicializan cuando solo hostapd est\u00e1 gestionando la interfaz wlan. Y si hostapd recibe una trama de acci\u00f3n ANQP Query REQ incluso de una STA no asociada, el controlador brcmfmac intenta usar un puntero vif P2P no inicializado para enviar el IOVAR al firmware. Esta desreferenciaci\u00f3n de puntero NULL desencadena un fallo del controlador.\n\n [ 1417.074538] No se puede manejar la desreferenciaci\u00f3n de puntero NULL del kernel en la direcci\u00f3n virtual\n address 0000000000000000\n [...]\n [ 1417.075188] Nombre del hardware: Raspberry Pi 4 Model B Rev 1.5 (DT)\n [...]\n [ 1417.075653] Rastro de llamada:\n [ 1417.075662]  brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]\n [ 1417.075738]  brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]\n [ 1417.075810]  cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]\n [ 1417.076067]  nl80211_tx_mgmt+0x238/0x388 [cfg80211]\n [ 1417.076281]  genl_family_rcv_msg_doit+0xe0/0x158\n [ 1417.076302]  genl_rcv_msg+0x220/0x2a0\n [ 1417.076317]  netlink_rcv_skb+0x68/0x140\n [ 1417.076330]  genl_rcv+0x40/0x60\n [ 1417.076343]  netlink_unicast+0x330/0x3b8\n [ 1417.076357]  netlink_sendmsg+0x19c/0x3f8\n [ 1417.076370]  __sock_sendmsg+0x64/0xc0\n [ 1417.076391]  ____sys_sendmsg+0x268/0x2a0\n [ 1417.076408]  ___sys_sendmsg+0xb8/0x118\n [ 1417.076427]  __sys_sendmsg+0x90/0xf8\n [ 1417.076445]  __arm64_sys_sendmsg+0x2c/0x40\n [ 1417.076465]  invoke_syscall+0x50/0x120\n [ 1417.076486]  el0_svc_common.constprop.0+0x48/0xf0\n [ 1417.076506]  do_el0_svc+0x24/0x38\n [ 1417.076525]  el0_svc+0x30/0x100\n [ 1417.076548]  el0t_64_sync_handler+0x100/0x130\n [ 1417.076569]  el0t_64_sync+0x190/0x198\n [ 1417.076589] C\u00f3digo: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)\n\nSoluciona esto, usando siempre la vif correspondiente al wdev en la que la solicitud de transmisi\u00f3n de trama de acci\u00f3n fue iniciada por el espacio de usuario. De esta manera, incluso si la vif P2P no est\u00e1 disponible, el IOVAR se env\u00eda al firmware en la vif AP y la trama de acci\u00f3n ANQP Query RESP se transmite sin que el controlador falle.\n\nMover init_completion() para \u0027send_af_done\u0027 de brcmf_p2p_create_p2pdev() a brcmf_p2p_attach(). Porque la funci\u00f3n anterior no se ejecutar\u00eda cuando solo hostapd est\u00e1 gestionando la interfaz wlan, y no es seguro hacer reinit_completion() m\u00e1s tarde en brcmf_p2p_tx_action_frame(), sin ninguna init_completion() previa.\n\nY en la funci\u00f3n brcmf_p2p_tx_action_frame(), la comprobaci\u00f3n de condici\u00f3n para la trama de respuesta de presencia P2P no es necesaria, ya que wpa_supplicant est\u00e1 enviando correctamente la trama de respuesta de presencia P2P en la vif P2P-GO en lugar de la vif P2P-Device.\n\n[Cc estable]"
    }
  ],
  "id": "CVE-2025-40321",
  "lastModified": "2026-10-14T22:10:00.210",
  "metrics": {},
  "published": "2025-12-08T01:16:04.793",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3776c685ebe5f43e9060af06872661de55e80b9a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/55f60a72a178909ece4e32987e4c642ba57e1cf4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/64e3175d1c8a3bea02032e7c9d1befd5f43786fa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a6eed58249e7d60f856900e682992300f770f64b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c2b0f8d3e7358c33d90f0e62765d474f25f26a45"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c863b9c7b4e9af0b7931cb791ec91971a50f1a25"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e1fc9afcce9139791260f962541282d47fbb508d"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}

CVE-2025-40321 (GCVE-0-2025-40321)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2026-05-11 21:47

Title

wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode

Summary

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7033 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/c863b9c7b4e9af0b7…
https://git.kernel.org/stable/c/e1fc9afcce9139791…
https://git.kernel.org/stable/c/55f60a72a178909ec…
https://git.kernel.org/stable/c/c2b0f8d3e7358c33d…
https://git.kernel.org/stable/c/64e3175d1c8a3bea0…
https://git.kernel.org/stable/c/a6eed58249e7d60f8…
https://git.kernel.org/stable/c/dbc7357b6aae686d9…
https://git.kernel.org/stable/c/3776c685ebe5f43e9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < c863b9c7b4e9af0b7931cb791ec91971a50f1a25 (git) Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < e1fc9afcce9139791260f962541282d47fbb508d (git) Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < 55f60a72a178909ece4e32987e4c642ba57e1cf4 (git) Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < c2b0f8d3e7358c33d90f0e62765d474f25f26a45 (git) Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < 64e3175d1c8a3bea02032e7c9d1befd5f43786fa (git) Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < a6eed58249e7d60f856900e682992300f770f64b (git) Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a (git) Affected: 18e2f61db3b708e0a22ccc403cb6ab2203d6faab , < 3776c685ebe5f43e9060af06872661de55e80b9a (git)
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 5.4.302 , ≤ 5.4.* (semver) Unaffected: 5.10.247 , ≤ 5.10.* (semver) Unaffected: 5.15.197 , ≤ 5.15.* (semver) Unaffected: 6.1.159 , ≤ 6.1.* (semver) Unaffected: 6.6.117 , ≤ 6.6.* (semver) Unaffected: 6.12.58 , ≤ 6.12.* (semver) Unaffected: 6.17.8 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c863b9c7b4e9af0b7931cb791ec91971a50f1a25",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "e1fc9afcce9139791260f962541282d47fbb508d",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "55f60a72a178909ece4e32987e4c642ba57e1cf4",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "c2b0f8d3e7358c33d90f0e62765d474f25f26a45",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "64e3175d1c8a3bea02032e7c9d1befd5f43786fa",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "a6eed58249e7d60f856900e682992300f770f64b",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            },
            {
              "lessThan": "3776c685ebe5f43e9060af06872661de55e80b9a",
              "status": "affected",
              "version": "18e2f61db3b708e0a22ccc403cb6ab2203d6faab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c",
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.302",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode\n\nCurrently, whenever there is a need to transmit an Action frame,\nthe brcmfmac driver always uses the P2P vif to send the \"actframe\" IOVAR to\nfirmware. The P2P interfaces were available when wpa_supplicant is managing\nthe wlan interface.\n\nHowever, the P2P interfaces are not created/initialized when only hostapd\nis managing the wlan interface. And if hostapd receives an ANQP Query REQ\nAction frame even from an un-associated STA, the brcmfmac driver tries\nto use an uninitialized P2P vif pointer for sending the IOVAR to firmware.\nThis NULL pointer dereferencing triggers a driver crash.\n\n [ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual\n address 0000000000000000\n [...]\n [ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n [...]\n [ 1417.075653] Call trace:\n [ 1417.075662]  brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]\n [ 1417.075738]  brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]\n [ 1417.075810]  cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]\n [ 1417.076067]  nl80211_tx_mgmt+0x238/0x388 [cfg80211]\n [ 1417.076281]  genl_family_rcv_msg_doit+0xe0/0x158\n [ 1417.076302]  genl_rcv_msg+0x220/0x2a0\n [ 1417.076317]  netlink_rcv_skb+0x68/0x140\n [ 1417.076330]  genl_rcv+0x40/0x60\n [ 1417.076343]  netlink_unicast+0x330/0x3b8\n [ 1417.076357]  netlink_sendmsg+0x19c/0x3f8\n [ 1417.076370]  __sock_sendmsg+0x64/0xc0\n [ 1417.076391]  ____sys_sendmsg+0x268/0x2a0\n [ 1417.076408]  ___sys_sendmsg+0xb8/0x118\n [ 1417.076427]  __sys_sendmsg+0x90/0xf8\n [ 1417.076445]  __arm64_sys_sendmsg+0x2c/0x40\n [ 1417.076465]  invoke_syscall+0x50/0x120\n [ 1417.076486]  el0_svc_common.constprop.0+0x48/0xf0\n [ 1417.076506]  do_el0_svc+0x24/0x38\n [ 1417.076525]  el0_svc+0x30/0x100\n [ 1417.076548]  el0t_64_sync_handler+0x100/0x130\n [ 1417.076569]  el0t_64_sync+0x190/0x198\n [ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)\n\nFix this, by always using the vif corresponding to the wdev on which the\nAction frame Transmission request was initiated by the userspace. This way,\neven if P2P vif is not available, the IOVAR is sent to firmware on AP vif\nand the ANQP Query RESP Action frame is transmitted without crashing the\ndriver.\n\nMove init_completion() for \"send_af_done\" from brcmf_p2p_create_p2pdev()\nto brcmf_p2p_attach(). Because the former function would not get executed\nwhen only hostapd is managing wlan interface, and it is not safe to do\nreinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior\ninit_completion().\n\nAnd in the brcmf_p2p_tx_action_frame() function, the condition check for\nP2P Presence response frame is not needed, since the wpa_supplicant is\nproperly sending the P2P Presense Response frame on the P2P-GO vif instead\nof the P2P-Device vif.\n\n[Cc stable]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:47:06.255Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c863b9c7b4e9af0b7931cb791ec91971a50f1a25"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1fc9afcce9139791260f962541282d47fbb508d"
        },
        {
          "url": "https://git.kernel.org/stable/c/55f60a72a178909ece4e32987e4c642ba57e1cf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2b0f8d3e7358c33d90f0e62765d474f25f26a45"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e3175d1c8a3bea02032e7c9d1befd5f43786fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6eed58249e7d60f856900e682992300f770f64b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbc7357b6aae686d9404e1dd7e2e6cf92c3a1b5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3776c685ebe5f43e9060af06872661de55e80b9a"
        }
      ],
      "title": "wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40321",
    "datePublished": "2025-12-08T00:46:48.724Z",
    "dateReserved": "2025-04-16T07:20:57.186Z",
    "dateUpdated": "2026-05-11T21:47:06.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted