CVE-2026-53093: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53093 Overview

CVE-2026-53093 is a Linux kernel vulnerability in the Broadcom FullMAC WLAN driver (brcmfmac). The flaw stems from an unchecked return value of brcmf_chip_add_core(), which can return an error pointer (ERR_PTR) that is subsequently dereferenced in brcmf_chip_recognition(). Static analysis tool Smatch detected the issue across multiple call sites in drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c. The vulnerability falls under [CWE-476] Null Pointer Dereference and can lead to kernel-level instability or denial of service when triggered during Wi-Fi chip recognition.

Critical Impact
Dereferencing an error pointer during Broadcom Wi-Fi chip initialization can cause kernel oops conditions, leading to system crashes and denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the brcmfmac Broadcom FullMAC WLAN driver prior to the patched commits
Systems using Broadcom Wi-Fi chipsets handled by brcmfmac
Multiple stable kernel branches as indicated by the eight backport commits in kernel.org

Discovery Timeline

2026-06-24 - CVE-2026-53093 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53093

Vulnerability Analysis

The vulnerability resides in the brcmf_chip_recognition() function within drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c. This function calls brcmf_chip_add_core() to register Broadcom chip cores during driver initialization. The helper function returns either a valid struct brcmf_core * pointer or an ERR_PTR() value encoding a negative error code. The caller did not validate the returned pointer before dereferencing it on lines 1010, 1013, 1016, 1019, and 1022. Smatch flagged each of these sites as 'core' dereferencing possible ERR_PTR(). Dereferencing an ERR_PTR treats a small negative integer as a kernel virtual address, triggering an invalid memory access.

Root Cause

The root cause is missing error pointer validation. Linux kernel convention uses IS_ERR() to test pointers returned by functions that may signal failure through ERR_PTR(). The original code in brcmf_chip_recognition() assumed brcmf_chip_add_core() always returned a valid pointer. When the helper failed because of allocation issues or invalid chip identifiers, the unchecked dereference produced a kernel oops.

Attack Vector

The trigger path requires the brcmfmac driver to attempt chip recognition on a Broadcom Wi-Fi device. This typically occurs during driver probe at boot, hotplug, or module reload. Local users with the ability to attach USB or SDIO Broadcom Wi-Fi hardware, or systems that encounter malformed chip responses, can drive the failure condition. The result is a kernel crash and denial of service rather than memory corruption or privilege escalation.

No public proof-of-concept code is associated with this CVE. The fix adds IS_ERR() checks after each brcmf_chip_add_core() call to propagate the error rather than dereferencing the bad pointer. See the patch series across the eight referenced kernel.org commits for the exact code changes.

Detection Methods for CVE-2026-53093

Indicators of Compromise

Kernel oops messages referencing brcmf_chip_recognition or brcmf_chip_add_core in dmesg or /var/log/kern.log
Repeated brcmfmac driver probe failures followed by unexpected system reboots
BUG or general protection fault entries naming addresses in the low negative range typical of ERR_PTR values

Detection Strategies

Compare running kernel versions against the fixed commits listed on kernel.org to identify unpatched hosts
Monitor system logs for kernel panic signatures involving the brcm80211 module stack
Use distribution package auditing tools such as dnf updateinfo or apt list --upgradable to identify pending kernel security updates

Monitoring Recommendations

Forward kernel logs to a centralized log analytics platform and alert on Oops or BUG: entries citing brcmfmac
Track Wi-Fi driver probe outcomes across fleets that use Broadcom chipsets
Inventory endpoints with Broadcom Wi-Fi hardware to prioritize patching

How to Mitigate CVE-2026-53093

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org commit list for your stable branch
Update to a distribution kernel package that incorporates the brcmfmac error pointer check
Reboot affected systems after kernel update so the patched driver is loaded

Patch Information

The fix is published across eight stable backport commits, including 2e0e5a43ed12, 334c68750eee, 99ef54765917, a3b45090a91e, bd6c906e0c4a, cbea71b44803, d3f280be48f1, and dd8592fc6007. Each commit adds IS_ERR() validation after calls to brcmf_chip_add_core() in chip.c.

Workarounds

Blacklist the brcmfmac module on systems that do not require Broadcom Wi-Fi connectivity until a patched kernel is installed
Restrict physical and USB access to limit attachment of Broadcom Wi-Fi devices that could trigger the faulty code path
Disable Wi-Fi at the firmware or BIOS level on systems where wireless networking is not in use

bash

# Blacklist the brcmfmac driver until kernel is patched
echo "blacklist brcmfmac" | sudo tee /etc/modprobe.d/blacklist-brcmfmac.conf
sudo update-initramfs -u
sudo reboot