CVE-2025-39863 Overview
CVE-2025-39863 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Broadcom FullMAC WLAN driver (brcmfmac). The flaw resides in the Bluetooth coexistence (btcoex) subsystem, where a race condition between brcmf_btcoex_detach() and the timer handler brcmf_btcoex_timerfunc() allows a worker to be rescheduled after the brcmf_btcoex_info struct is freed. Exploitation of the resulting stale pointer dereference can lead to memory corruption in kernel context. The issue affects mainline Linux kernel builds up to and including 6.17 release candidates.
Critical Impact
Local attackers with low privileges can trigger kernel-mode use-after-free conditions, potentially resulting in privilege escalation or denial of service on systems using Broadcom Wi-Fi hardware.
Affected Products
- Linux Kernel (multiple stable branches, per upstream commits)
- Linux Kernel 6.17-rc1, 6.17-rc2, 6.17-rc3, 6.17-rc4
- Distributions shipping the brcmfmac driver for Broadcom FullMAC Wi-Fi devices
Discovery Timeline
- 2025-09-19 - CVE-2025-39863 published to the National Vulnerability Database
- 2026-06-19 - Last updated in NVD database
Technical Details for CVE-2025-39863
Vulnerability Analysis
The vulnerability is a classic time-of-check to time-of-use race between a teardown path and a timer callback. In brcmf_btcoex_detach(), the driver guards timer shutdown with the condition if (cfg->btcoex->timer_on) before calling timer_shutdown_sync(). However, the timer handler brcmf_btcoex_timerfunc() itself sets timer_on = false as part of normal execution.
When detach runs concurrently with the timer handler, the check can observe timer_on as false and skip synchronous shutdown. The handler then calls schedule_work(&bt_local->work) after cancel_work_sync() has already returned. The subsequent kfree(cfg->btcoex) leaves a scheduled worker referencing freed memory.
Two exploitation scenarios exist. In the first, the worker is scheduled after kfree(), causing schedule_work() to operate on freed workqueue state. In the second, the worker begins executing brcmf_btcoex_handler() and dereferences the freed brcmf_btcoex_info object through the container_of macro. Both paths yield unpredictable kernel memory access.
Root Cause
The root cause is unsafe reliance on the timer_on flag as a synchronization primitive. The flag is mutated by the timer handler itself without locking, so its value cannot reliably indicate whether the timer or its rescheduled work is still active. The fix removes the conditional and calls timer_shutdown_sync() unconditionally, which safely deactivates the timer regardless of state.
Attack Vector
Exploitation requires local access with low privileges on a system running the vulnerable brcmfmac driver. An attacker triggers repeated interface teardown and Bluetooth coexistence activity to widen the race window. Successful races corrupt kernel memory and may enable privilege escalation to root or cause kernel panics. Remote exploitation over Wi-Fi is not the primary vector, but adversary-induced link state changes could contribute to reproducing the race.
Because the affected code is a kernel driver, no user-space exploit primitive is required beyond the ability to load or interact with the driver. See the upstream fix commits at Linux Kernel Commit 2f6fbc8 and Linux Kernel Commit f115015 for the code-level remediation.
Detection Methods for CVE-2025-39863
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing brcmf_btcoex_handler, brcmf_btcoex_timerfunc, or container_of in kernel logs.
- KASAN reports flagging use-after-free in the brcmfmac module during Wi-Fi interface teardown or suspend/resume cycles.
- Repeated WARN_ON traces originating from workqueue subsystem operations tied to brcmf_btcoex_info.
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) builds in test environments to surface the use-after-free during fuzzing of Wi-Fi teardown paths.
- Monitor dmesg and journalctl -k output for driver-level crash signatures on endpoints with Broadcom Wi-Fi chipsets.
- Correlate module reload, suspend, and Bluetooth radio state transitions with kernel error events in centralized logging.
Monitoring Recommendations
- Ingest kernel logs into a centralized data lake and alert on brcmfmac-scoped panics or oops entries.
- Track kernel version inventory across fleet endpoints to identify hosts still running pre-patch builds.
- Baseline normal Wi-Fi driver restart frequency and flag anomalous bursts consistent with race-condition probing.
How to Mitigate CVE-2025-39863
Immediate Actions Required
- Apply the upstream kernel patches referenced in the vendor advisories and rebuild or update affected kernels.
- Prioritize patching on laptops and embedded devices using Broadcom FullMAC Wi-Fi hardware where brcmfmac is loaded.
- Restrict local shell access on multi-user Linux hosts until patches are deployed, given the local attack vector.
Patch Information
The fix removes the conditional check on timer_on and calls timer_shutdown_sync() directly in brcmf_btcoex_detach(), ensuring the timer is deactivated reliably before the associated work is cancelled and memory is freed. Backports are available across stable branches. See Linux Kernel Commit 3e789f8, Linux Kernel Commit 9cb83d4, Linux Kernel Commit ae58f70, and Linux Kernel Commit c75600e for stable-tree backports.
Workarounds
- Blacklist the brcmfmac module on systems that do not require Broadcom Wi-Fi functionality until the kernel is patched.
- Disable Bluetooth on affected devices to reduce activation of the coexistence code path.
- Limit local user access and enforce least-privilege policies to reduce the pool of potential local attackers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
