CVE-2025-21744

MEDIUM EPSS 11.3%
Published Feb 27, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Feb 27, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() On removal of the device or unloading of the kernel module a potential NULL pointer dereference occurs. The following sequence deletes the interface: brcmf_detach() brcmf_remove_interface() brcmf_del_if() Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches. After brcmf_remove_interface() call the brcmf_proto_detach() function is called providing the following sequence: brcmf_detach() brcmf_proto_detach() brcmf_proto_msgbuf_detach() brcmf_flowring_detach() brcmf_msgbuf_delete_flowring() brcmf_msgbuf_remove_flowring() brcmf_flowring_delete() brcmf_get_ifp() brcmf_txfinalize() Since brcmf_get_ip() can and actually will return NULL in this case the call to brcmf_txfinalize() will result in a NULL pointer dereference inside brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors. This will only happen if a flowring still has an skb. Although the NULL pointer dereference has only been seen when trying to update the tx statistic, all other uses of the ifp pointer have been guarded as well with an early return if ifp is NULL.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
11.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel* <6.1.129
linuxlinux_kernel*≥6.2  –  <6.6.78
linuxlinux_kernel*≥6.7  –  <6.12.14
linuxlinux_kernel*≥6.13  –  <6.13.3

References 11

  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-265688.html
  • git.kernel.org https://git.kernel.org/stable/c/2326e19190e176fd72bb542b837a9d2b7fcb8693
  • git.kernel.org https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/59ff4fa653ff6db07c61152516ffba79c2a74bda
  • git.kernel.org https://git.kernel.org/stable/c/61541d9b5a23df33934fcc620a3a81f246b1b240
  • git.kernel.org https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58
    Patch