{"id":"CVE-2026-99061","kind":"vulnerability","aliases":["CVE-2026-99061"],"related":[],"title":"Linux kernel: brcmfmac P2P device removal race crashes the kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n   device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n   calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n   1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n   which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n   and calls brcmf_remove_interface(ifp, false) for the same ifp.\n   brcmf_p2p_ifp_removed() reads ifp->vif and then blocks on\n   rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n   cfg80211_unregister_wdev() on the wdev that was already unregistered\n   and freed.\n\nThe second list_del_rcu() of wdev->list faults on LIST_POISON2:\n\n  brcmfmac: brcmf_p2p_del_vif delete P2P vif\n  brcmfmac: brcmf_p2p_deinit_discovery enter\n  brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n  brcmfmac: brcmf_detach Enter\n  brcmfmac: brcmf_bus_change_state 1 -> 0\n  brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n  [1.5 s later, brcmf_p2p_del_vif() timed out]\n  brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n  Unable to handle kernel paging request at virtual address dead000000000122\n  Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n  pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n  Call trace:\n   _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n   cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n   brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n   brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n   brcmf_detach+0x88/0x180 [brcmfmac]\n   brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n   brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n   brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n   sdio_bus_remove+0x38/0x144\n   device_release_driver_internal+0x1e8/0x2c0\n   device_release_driver+0x14/0x20\n   brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n   brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n   __exit_compat+0x18/0x418 [brcmfmac_cyw]\n   __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug=0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n  1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n     P2P device (iw dev shows \"type P2P-device\").\n  2. Stop wpa_supplicant and remove the driver without waiting for\n     wpa_supplicant to exit:\n\n       kill $(pidof wpa_supplicant)\n       rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface.","summary":"When the brcmfmac Wi-Fi driver is removed while wpa_supplicant is still exiting, the P2P device interface is removed twice and the kernel oopses. The sources describe a crash (denial of service) and do not describe code execution.","severity":"low","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brcmfmac","embedded","infrastructure","linux-kernel","sdio","wifi"],"not_affected_if":["driver-never-removed","no-brcmfmac-driver","no-p2p-device"],"how_to_check":"- `uname -r` and check whether the kernel includes the brcmfmac fix for the P2P device removal race in brcmf_detach()\n- `lsmod | grep brcmfmac` to see whether the brcmfmac driver is loaded on the machine\n- `iw dev` to see whether a P2P-device interface exists on a Broadcom/Cypress SDIO Wi-Fi board","fix":"- Update the Linux kernel to a release that includes the upstream fix for the brcmfmac P2P device removal race in brcmf_detach(); exact fixed version: unknown\n- Vendor backports (e.g. Ezurio brcmfmac on 5.4-rt): apply the vendor's updated driver; version: unknown","status":"open","published_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:53:56+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:53:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for the brcmfmac P2P device removal race in brcmf_detach(); exact fixed version: unknown\n- Vendor backports (e.g. Ezurio brcmfmac on 5.4-rt): apply the vendor's updated driver; version: unknown","reach":"local","title":"Linux kernel: brcmfmac P2P device removal race crashes the kernel","impact":"low","summary":"When the brcmfmac Wi-Fi driver is removed while wpa_supplicant is still exiting, the P2P device interface is removed twice and the kernel oopses. The sources describe a crash (denial of service) and do not describe code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","brcmfmac","wifi","embedded","sdio"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel oops and crash when the driver is removed","analyst_note":"","how_to_check":"- `uname -r` and check whether the kernel includes the brcmfmac fix for the P2P device removal race in brcmf_detach()\n- `lsmod | grep brcmfmac` to see whether the brcmfmac driver is loaded on the machine\n- `iw dev` to see whether a P2P-device interface exists on a Broadcom/Cypress SDIO Wi-Fi board","needs_analyst":false,"not_affected_if":["no-brcmfmac-driver","no-p2p-device","driver-never-removed"],"who_is_affected":"Systems that load the brcmfmac Wi-Fi driver (Broadcom/Cypress/Infineon chips on SDIO, such as the CYW55513 on an i.MX 8M Plus board) and where wpa_supplicant creates a P2P device. The crash needs the driver to be removed or unloaded while wpa_supplicant is still exiting, so systems that never unload brcmfmac are unlikely to hit it. unknown whether other bus types are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000867,"input_tokens":5048,"output_tokens":725,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':371C,379C,385C,392C,398C,403C,409C,415C,422C,428C,434C,439C,445C,452C,457C,465C '-2026':12A,15A '-99061':13A,16A '0':285C,294C,303C,330C,339C '0x406':473C '1':284C,292C,301C,328C,337C,363C,512C '1.5':156C,313C '2':534C '5.4':499C '8m':477C '96000044':362C 'address':357C 'alreadi':234C 'arm64':461C 'arriv':192C 'associ':521C 'backport':492C 'block':213C 'board':479C,563C 'brcmf':83C,145C,159C,166C,180C,187C,195C,204C,218C,251C,259C,265C,276C,280C,287C,296C,305C,316C,323C,332C,341C,388C,395C,401C,406C,412C,418C,441C,448C,580C,592C,598C,605C,627C 'brcmfmac':3A,17B,27B,76C,250C,258C,264C,275C,279C,286C,295C,304C,322C,331C,340C,394C,400C,405C,411C,417C,424C,447C,454C,459C,494C,554C,556C 'bsscfgidx':291C,300C,327C,336C 'bus':184C,281C,426C,443C 'call':144C,165C,194C,225C,374C 'cfg80211':226C,368C,373C,376C,381C,382C,387C 'chang':282C 'clear':274C 'cmd':127C 'code':63B,503C 'compat':456C 'crash':8A,55B,116C,558C 'creat':96C,523C 'cve':11A,14A 'cyw':460C,555C 'cyw55513':482C 'dead000000000122':358C 'debug':472C 'deinit':261C 'del':128C,135C,147C,162C,190C,220C,241C,253C,267C,297C,318C,333C,594C,628C 'delet':255C,463C 'denial':56B 'describ':53B,62B 'detach':84C,181C,277C,402C,581C,599C,606C 'dev':528C 'devic':5A,42B,79C,99C,108C,133C,310C,346C,430C,436C,526C,533C,572C 'disabl':150C 'discoveri':151C,262C 'driver':31B,87C,432C,438C,488C,541C 'e':160C,188C 'e.g':100C 'embed':18B 'empti':603C 'enter':263C,278C,290C,299C,326C,335C 'error':360C 'execut':64B 'exit':39B,105C,124C,455C,548C 'ezurio':491C 'fals':199C 'fault':246C 'fi':30B 'find':600C,612C 'first':597C,608C 'fix':77C 'follow':70C 'free':174C 'freed':237C 'fwvid':449C 'go':270C 'handl':351C 'hold':137C 'i.mx':476C 'if513':484C 'ifidx':293C,302C,329C,338C 'iflist':584C 'ifp':179C,198C,203C,206C,209C,307C,343C,390C 'infrastructur':19B 'interfac':43B,109C,129C,136C,168C,197C,289C,311C,325C,347C,397C,566C,618C,638C 'intern':359C,433C 'involv':504C 'iw':527C 'kernel':2A,10A,22B,49B,68C,115C,352C,501C 'kill':549C 'later':315C 'let':519C 'linux':1A,21B,67C 'linux-kernel':20B 'list':240C,245C,248C 'lock':216C,589C 'log':468C 'mainlin':509C 'modul':464C 'mutex':142C,578C 'neg':271C 'netdev':569C,621C 'never':191C 'nl80211':126C,134C,609C 'oop':361C 'oops':50B 'op':419C 'p2p':4A,41B,78C,98C,107C,132C,146C,205C,219C,252C,256C,260C,266C,269C,306C,309C,317C,342C,345C,389C,525C,532C,571C,593C 'p2p-device':531C 'page':353C 'path':119C 'pc':367C 'phase':272C 'pidof':550C 'plus':478C 'poison2':249C 'preempt':364C 'primari':637C 'process':94C 'race':7A,81C 'rcu':242C 'read':208C,583C 'releas':222C,431C,437C 'remov':6A,33B,45B,80C,89C,111C,167C,196C,207C,288C,308C,312C,324C,344C,348C,391C,396C,408C,414C,421C,427C,444C,539C,586C,623C 'reproduc':511C,560C 'request':354C 'resolv':74C 'rmmod':553C 'rt':365C,500C 'rtnl':138C,215C,223C,574C,631C 'run':596C,607C 'sdio':23B,407C,420C,425C,442C,486C 'sdiod':413C 'second':239C 'send':125C 'servic':58B 'set':182C 'show':529C 'slot':602C 'smp':366C 'sona':483C 'sourc':52B 'space':93C 'start':513C 'state':283C 'status':273C 'still':38B,104C 'stop':535C 'supplic':36B,102C,122C,515C,537C,546C,552C 'sys':462C 'take':573C,630C 'taken':470C 'time':320C 'trace':375C 'true':590C 'twice':46B,112C 'two':118C 'type':530C 'unabl':349C 'unregist':170C,227C,235C,369C,377C,383C,450C 'user':92C 'v6.18.22':496C 'vendor':451C 'vif':148C,176C,210C,221C,254C,257C,268C,319C,595C 'virtual':356C 'vulner':71C 'wait':153C,543C 'wdev':172C,228C,231C,244C,370C,378C,384C,614C 'wi':29B 'wi-fi':28B 'wifi':24B,75C 'wiphi':141C,577C 'without':542C,567C 'wlan0':517C 'wpa':35B,101C,121C,514C,536C,545C,551C 'x10/0x1c':386C 'x14/0x20':440C 'x18/0x418':458C 'x1ac/0x244':466C 'x1e8/0x2c0':435C 'x1f4/0x254':399C 'x20/0xa0':416C 'x2c/0x40':446C 'x38/0x144':429C 'x6c/0x264':372C,380C 'x84/0xb0':393C 'x88/0x180':404C 'x90/0x7b0':410C 'xbc/0x12c':423C 'xd8/0x170':453C","nicknames":[],"mitigations":[],"who_affected":"Systems that load the brcmfmac Wi-Fi driver (Broadcom/Cypress/Infineon chips on SDIO, such as the CYW55513 on an i.MX 8M Plus board) and where wpa_supplicant creates a P2P device. The crash needs the driver to be removed or unloaded while wpa_supplicant is still exiting, so systems that never unload brcmfmac are unlikely to hit it. unknown whether other bus types are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99061","severity":null,"published_at":"2026-10-23T13:17:29+00:00","modified_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99061","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99061","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}