CVE-2026-80949: Linux Kernel brcmfmac Memory Leak Vulnerability

CVE-2026-80949 Overview

CVE-2026-80949 is a memory leak vulnerability in the Linux kernel's Broadcom FullMAC (brcmfmac) WiFi driver. The flaw resides in the brcmf_sdio_read_control() function, where memory allocated to the buf buffer is not released along certain error paths. Repeated triggering of these error conditions gradually exhausts kernel memory, degrading system stability over time. The upstream fix adds the missing vfree() calls to release the buffer on all failure branches.

Critical Impact
Sustained exercise of the affected SDIO control read path can exhaust kernel memory on systems using Broadcom SDIO-attached WiFi chips, leading to degraded performance or denial of service.

Affected Products

Linux kernel brcmfmac WiFi driver (SDIO transport)
Multiple stable Linux kernel branches referenced by the upstream fix commits
Systems using Broadcom FullMAC WiFi chipsets over SDIO

Discovery Timeline

2026-09-11 - CVE-2026-80949 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80949

Vulnerability Analysis

The brcmf_sdio_read_control() function in the brcmfmac driver allocates a working buffer using a vmalloc-family allocator before performing SDIO control reads for Broadcom FullMAC WiFi devices. Several error branches in the function return without invoking vfree() on the allocated buffer, so the kernel leaks memory each time those branches execute.

Because the function runs during WiFi control message handling, transient bus errors, malformed frames, or adverse RF conditions can repeatedly drive execution into the leaking paths. Over long uptimes or under stress, cumulative leakage reduces available kernel memory, which can slow the system, trigger allocation failures elsewhere, or produce a denial-of-service condition. The issue is a classic Memory Leak defect in a device driver cleanup path.

Root Cause

The root cause is missing resource release on error. The function allocates buf, but not every failure branch reaches the cleanup logic that frees it. The upstream fix, reworked based on maintainer feedback, adds vfree() calls to the affected error paths so buf is released in all exit conditions.

Attack Vector

The vulnerable code executes in the SDIO WiFi receive path. Triggering the leak requires conditions that push brcmf_sdio_read_control() into its error branches, typically physical proximity to the affected wireless device or the ability to influence traffic and bus state. This limits practical exploitation to local or radio-adjacent scenarios rather than remote network attackers.

No verified public exploit code is available. The vulnerability is described in prose based on the upstream commit messages; see the referenced kernel commits for the exact diff.

Detection Methods for CVE-2026-80949

Indicators of Compromise

Steady, unexplained growth in kernel vmalloc usage on hosts with Broadcom SDIO WiFi adapters.
Recurring brcmfmac driver warnings or SDIO control read errors in dmesg prior to memory pressure events.
Out-of-memory killer activity on otherwise lightly loaded systems that use the brcmfmac driver.

Detection Strategies

Compare running kernel versions against the fixed commits listed in the Linux kernel stable tree references to identify unpatched hosts.
Monitor /proc/meminfo (VmallocUsed) and /proc/vmallocinfo on affected systems for abnormal growth correlated with WiFi activity.
Aggregate kernel logs centrally and alert on repeated brcmf_sdio_read_control error messages.

Monitoring Recommendations

Baseline kernel memory metrics per host class and alert on sustained deviations that exceed normal WiFi workload patterns.
Track kernel and driver package versions across the fleet through configuration management to detect regressions.
Correlate WiFi link quality events with driver error logs to identify environments that reliably trigger the leaking error paths.

How to Mitigate CVE-2026-80949

Immediate Actions Required

Inventory Linux hosts using the brcmfmac driver over SDIO, including embedded devices, IoT gateways, and single-board computers.
Apply vendor kernel updates that incorporate the upstream fix commits referenced in NVD.
Reboot affected systems after patching to clear any leaked kernel memory accumulated pre-patch.

Patch Information

The fix adds missing vfree() calls to the error paths in brcmf_sdio_read_control(). Multiple stable kernel branches received backports, tracked in commits 0d10db8, 261d7c7, 7704f6b, 86b57fa, a732c4f, b1d0a90, ba04715, and fdb880a. Consume the fix through your distribution's kernel updates.

Workarounds

Unload the brcmfmac module on systems that do not require Broadcom SDIO WiFi connectivity until a patched kernel is deployed.
Restrict physical and radio access to affected devices to reduce opportunities for triggering the vulnerable error paths.
Schedule periodic reboots for long-running systems that cannot be immediately patched to reclaim leaked kernel memory.

bash

# Identify whether the brcmfmac driver is loaded and in use
lsmod | grep brcmfmac

# If unused, blacklist the module until patched kernels are deployed
echo 'blacklist brcmfmac' | sudo tee /etc/modprobe.d/blacklist-brcmfmac.conf
sudo update-initramfs -u

# Monitor vmalloc usage for signs of ongoing leakage
watch -n 30 'grep -E "VmallocUsed|VmallocTotal" /proc/meminfo'