CVE-2026-43110: Linux Kernel Privilege Escalation Flaw

CVE-2026-43110 Overview

CVE-2026-43110 is a Linux kernel vulnerability in the brcmfmac Broadcom FullMAC Wi-Fi driver. The flaw resides in brcmf_fweh_handle_if_event(), which processes interface (IF) events delivered by the Wi-Fi firmware. The function validates the firmware-provided interface index before touching drvr->iflist[], but it uses the raw bsscfgidx field as an array index without a matching range check. A malformed or malicious IF event carrying an out-of-range bsscfgidx value can therefore drive an out-of-bounds array access in the kernel. The issue has been resolved upstream by rejecting IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array.

Critical Impact
An out-of-bounds index in kernel-mode Wi-Fi event handling can lead to memory corruption, kernel panic, or denial of service on systems using Broadcom FullMAC adapters.

Affected Products

Linux kernel — drivers/net/wireless/broadcom/brcm80211/brcmfmac (the brcmfmac Broadcom FullMAC Wi-Fi driver)
Linux distributions and devices shipping vulnerable kernel versions with Broadcom FullMAC Wi-Fi hardware
Embedded and IoT systems using Broadcom Wi-Fi chipsets supported by brcmfmac

Discovery Timeline

2026-05-06 - CVE-2026-43110 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43110

Vulnerability Analysis

The brcmfmac driver receives firmware event handler (FWEH) messages from the Wi-Fi firmware over the host interface. Among these messages are IF events that signal the creation, removal, or change of a virtual interface tied to a bsscfg (BSS configuration). The function brcmf_fweh_handle_if_event() consumes these events and updates the driver's per-interface state stored in drvr->iflist[]. Although the function checks the interface index extracted from the event, it then uses the separate bsscfgidx field as an unchecked index into the same iflist[] array. Because bsscfgidx is attacker-influenceable through firmware-level input, a value outside the iflist[] bounds reaches the array dereference and reads or writes memory adjacent to the array.

Root Cause

The root cause is missing input validation [CWE-129] on the bsscfgidx field used as an array index. The driver enforces a range check on one identifier but not on bsscfgidx, leaving the second indexing path unguarded. The upstream fix rejects IF events whose bsscfgidx exceeds the size of drvr->iflist[] before any array access occurs.

Attack Vector

Exploitation requires the host to process a crafted IF event from the Wi-Fi firmware. This places the attack surface at the firmware-host boundary of the brcmfmac driver. An attacker who can influence firmware events—through compromised firmware, a malicious device, or a downstream interface that injects events—can trigger the out-of-bounds index. The most likely impact is kernel memory corruption leading to denial of service, with further impact dependent on the surrounding allocation layout.

No verified public exploit code is available. Refer to the upstream kernel commits for the precise patch:

Detection Methods for CVE-2026-43110

Indicators of Compromise

Unexpected kernel oops or panic messages referencing brcmf_fweh_handle_if_event or brcmfmac in dmesg or /var/log/kern.log.
KASAN or slab-out-of-bounds warnings tied to the iflist symbol in the brcmfmac driver.
Repeated Wi-Fi interface resets, firmware reloads, or driver re-initialization on systems using Broadcom FullMAC adapters.

Detection Strategies

Inventory hosts running vulnerable Linux kernels with the brcmfmac module loaded using lsmod | grep brcmfmac and kernel version checks.
Correlate kernel crash telemetry across endpoints to identify clusters of brcmfmac-related faults that may indicate exploitation attempts.
Apply kernel address sanitizers in test fleets and lab images to surface out-of-bounds index conditions during regression testing.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging or SIEM platform and alert on driver-level panics involving brcmfmac.
Track kernel package versions across the fleet and flag systems still running pre-patch kernels.
Monitor proximity-based threat indicators where untrusted Wi-Fi peers or rogue access points appear repeatedly near affected devices.

How to Mitigate CVE-2026-43110

Immediate Actions Required

Update the Linux kernel to a version that includes one of the listed upstream commits adding the bsscfgidx range check in brcmf_fweh_handle_if_event().
Identify all systems using Broadcom FullMAC Wi-Fi hardware and prioritize them for patching, including laptops, embedded devices, and IoT endpoints.
Apply distribution-provided kernel updates as soon as vendors publish backports for supported stable branches.

Patch Information

The fix is committed upstream and backported to multiple stable trees. Reference commits include 1ae1e1caa428, 304950a467d8, 3ec7437e9d11, 9fca68c2512a, and b427c2b05222. Each adds an explicit range check on bsscfgidx against the bounds of drvr->iflist[] and rejects IF events that fail the check before any array access. Consult your Linux distribution's security advisories for the exact kernel package versions containing the fix.

Workarounds

Unload the brcmfmac module on systems that do not require Broadcom FullMAC Wi-Fi using modprobe -r brcmfmac, and blacklist it where feasible.
Disable Wi-Fi on affected hosts that operate primarily over wired networks until the kernel patch is applied.
Restrict device exposure to untrusted wireless environments and rogue access points while patching is in progress.

bash

# Verify kernel version and brcmfmac module status
uname -r
lsmod | grep brcmfmac

# Temporary workaround: unload and blacklist the driver
sudo modprobe -r brcmfmac
echo "blacklist brcmfmac" | sudo tee /etc/modprobe.d/blacklist-brcmfmac.conf
sudo update-initramfs -u