What’s Vulnerable › Vulnerabilities

CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-06 · updated 2026-10-19
• Weakness: CWE-129

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. [add missing wifi prefix]

Affected products

• Linux kernel: from 3.9 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5, 7.0-rc6 (+1) — fixed in 6.12.83, 6.18.24, 6.19.14, 6.6.136

How to fix

Upgrade to a fixed version: Linux kernel 6.12.83, 6.18.24, 6.19.14, 6.6.136. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d
• https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734
• https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d
• https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6
• https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c
• https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e
• https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54
• https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb
• https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Get alerted when CVE-2026-43110 or the next vulnerability affects your stack