CVE-2026-72003
Received Received - Intake

Heap Overflow in Linux Kernel WiFi Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow. Reject frames shorter than the management header offset before the copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72003
EUVD
EUVD-2026-59102

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
brcmfmac cyw *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap overflow vulnerability in the Linux kernel's brcmfmac Wi-Fi driver. It occurs when processing short authentication frames during SAE handshakes. The driver incorrectly calculates frame length, leading to a memcpy operation that writes beyond allocated memory due to an unsigned integer wrap-around. A malicious access point can exploit this to cause memory corruption.

Detection Guidance

This vulnerability involves a heap overflow in the brcmfmac Wi-Fi driver due to improper handling of short authentication frames. Detection requires monitoring for unusual network traffic or crashes in the Wi-Fi subsystem. Check kernel logs for oops or panic messages related to brcmfmac or Wi-Fi authentication failures.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to execute arbitrary code, crash the system, or gain elevated privileges on affected devices. Systems using vulnerable Wi-Fi drivers could be compromised through network access without user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations must patch systems promptly to maintain compliance with data protection standards.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch the brcmfmac driver. Disable external SAE authentication if not required. Monitor network traffic for malformed authentication frames. Restrict access to trusted access points only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72003. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart