CVE-2026-43144 Overview
CVE-2026-43144 affects the Linux kernel brcmfmac SDIO WiFi driver. The flaw causes a kernel oops when device probe fails due to conditions such as missing firmware. The driver assigns sdiodev->bus twice, first in brcmf_sdio_probe() and again in brcmf_sdiod_probe(). When probe fails, the bus pointer is set to an error value rather than NULL, so subsequent cleanup in brcmf_sdio_remove() attempts to free resources through an invalid pointer.
The upstream fix changes brcmf_sdio_probe() to return an error code, ensuring sdiodev->bus is assigned in only one location.
Critical Impact
A failed probe of a Broadcom SDIO WiFi device can trigger a kernel oops, leading to system instability or denial of service on affected Linux systems.
Affected Products
- Linux kernel brcmfmac SDIO WiFi driver
- Systems using Broadcom FullMAC SDIO WiFi adapters
- Devices commonly found in embedded boards, single-board computers, and laptops with Broadcom WiFi modules
Discovery Timeline
- 2026-05-06 - CVE-2026-43144 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43144
Vulnerability Analysis
The vulnerability resides in the Broadcom FullMAC (brcmfmac) SDIO bus driver in the Linux kernel. The driver loads firmware and initializes hardware during the SDIO probe sequence. When probe fails, the cleanup path executes brcmf_sdio_remove() to release allocated resources.
The defect is a logic flaw in pointer state management. The sdiodev->bus field is assigned in two separate functions during the probe sequence. If a step such as firmware loading fails between these assignments, the field can hold an ERR_PTR value rather than a valid pointer or NULL. The remove path does not distinguish between these states and dereferences the invalid pointer, producing a kernel oops.
This is a kernel driver vulnerability with characteristics aligned with improper error handling and invalid pointer dereference. Exploitation requires conditions that cause probe failure, most commonly missing or unloadable firmware files.
Root Cause
The root cause is duplicate assignment of sdiodev->bus across brcmf_sdio_probe() and brcmf_sdiod_probe(). The error path returns an ERR_PTR into the bus field, leaving the structure in an inconsistent state. The cleanup logic assumes the pointer is either valid or NULL and does not validate it before use.
Attack Vector
The issue is triggered locally during driver initialization. Any condition that forces probe failure on an SDIO brcmfmac device can reach the faulty cleanup path. Missing firmware on the filesystem is the most common trigger. Physical access or the ability to attach SDIO hardware is typically required, and the impact is denial of service through kernel instability.
The vulnerability does not have a public exploit and is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.017%, reflecting low likelihood of opportunistic exploitation.
No verified proof-of-concept code is available. Refer to the upstream commits referenced in the NVD entry for technical details of the fix.
Detection Methods for CVE-2026-43144
Indicators of Compromise
- Kernel oops messages referencing brcmf_sdio_remove or brcmfmac in dmesg or /var/log/kern.log
- firmware: failed to load errors from brcmfmac immediately preceding a kernel panic or warning
- Unexpected reboots or hung tasks on systems with Broadcom SDIO WiFi adapters after WiFi module load attempts
Detection Strategies
- Monitor kernel ring buffer output for brcmfmac probe failures followed by null pointer or invalid address dereferences
- Audit running kernel versions across Linux fleets and compare against patched versions referenced in the upstream stable commits
- Inspect /lib/firmware/brcm/ paths for missing firmware files that would trigger the failing probe path
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on Oops, BUG, or WARNING entries from brcmfmac
- Track kernel package versions through endpoint inventory tooling to identify hosts pending the fix
- Correlate SDIO device hotplug events with subsequent kernel error messages on embedded fleets
How to Mitigate CVE-2026-43144
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the Kernel Source Commit Change 1, Kernel Source Commit Change 2, and Kernel Source Commit Change 3
- Update to a distribution kernel that incorporates the fix once available from your vendor
- Verify that the appropriate Broadcom firmware files are installed under /lib/firmware/brcm/ to prevent probe failures from occurring in the first place
Patch Information
The fix modifies brcmf_sdio_probe() to return an error code rather than directly writing into sdiodev->bus. The bus pointer is now assigned in a single location, ensuring it is always either valid or NULL when cleanup runs. Linux distributions that maintain stable kernel branches should backport the referenced commits.
Workarounds
- Ensure the correct brcmfmac firmware blobs and NVRAM files for the specific chip variant are present before loading the driver
- Blacklist the brcmfmac module on systems where the WiFi adapter is not required by adding blacklist brcmfmac to a file in /etc/modprobe.d/
- Avoid hot-plugging Broadcom SDIO WiFi devices on unpatched kernels until the update is applied
# Configuration example: prevent brcmfmac from loading on unpatched hosts
echo 'blacklist brcmfmac' | sudo tee /etc/modprobe.d/disable-brcmfmac.conf
sudo update-initramfs -u
# Verify firmware presence before re-enabling the module
ls /lib/firmware/brcm/ | grep -i brcmfmac
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
