Description
The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Broadcom | brcmfmac WiFi driver | commit prior to a4176ec356c73a46c07c181c6d04039fafa34a9f | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.19.37-4 | — |
| Debian 13 | linux | 4.19.37-4 | — |
| Debian 12 | linux | 4.19.37-4 | — |
| Debian 9 | linux | 4.9.168-1+deb9u3 | DSA-4465-1 |
| Debian 8 | linux | 3.16.68-1 | DLA-1799-1 |
| Debian 8 | linux-4.9 | 4.9.168-1+deb9u3~deb8u1 | DLA-1824-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +3 | No fix yet | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-50.54 | USN-3981-1 |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1039.41 | USN-3981-1 |
| Ubuntu 18.04 LTS | linux-azure | 4.18.0-1018.18~18.04.1 | USN-3980-2 |
| Ubuntu 18.04 LTS | linux-gcp +1 | 4.15.0-1032.34 | USN-3981-1 |
| Ubuntu 18.04 LTS | linux-gcp-edge | 4.18.0-1011.12~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe | 4.18.0-20.21~18.04.1 | USN-3980-2 |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1034.34 | USN-3981-1 |
| Ubuntu 18.04 LTS | linux-oem | 4.15.0-1038.43 | USN-3981-1 |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1013.15 | USN-3981-1 |
| Ubuntu 18.04 LTS | linux-raspi2 | 4.15.0-1036.38 | USN-3981-1 |
| Ubuntu 18.04 LTS | linux-snapdragon | 4.15.0-1053.57 | USN-3981-1 |
| Ubuntu 16.04 LTS | linux | 4.4.0-157.185 | USN-4095-1, USN-4076-1 |
| Ubuntu 16.04 LTS | linux-aws | 4.4.0-1090.101 | USN-4095-1, USN-4076-1 |
| Ubuntu 16.04 LTS | linux-aws-hwe | 4.15.0-1039.41~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-azure | 4.15.0-1045.49 | USN-3981-2 |
| Ubuntu 16.04 LTS | linux-gcp | 4.15.0-1032.34~16.04.1 | USN-3981-2 |
| Ubuntu 16.04 LTS | linux-hwe | 4.15.0-50.54~16.04.1 | USN-3981-2 |
| Ubuntu 16.04 LTS | linux-kvm | 4.4.0-1052.59 | USN-4095-1, USN-4076-1 |
| Ubuntu 16.04 LTS | linux-oracle | 4.15.0-1013.15~16.04.1 | USN-3981-2 |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1117.126 | USN-4095-1, USN-4076-1 |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1121.127 | USN-4095-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux-azure | 4.15.0-1045.49~14.04.1 | USN-3981-2 |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | 4.4.0-1015.20 | — |
| Ubuntu Pro 14.04 LTS | linux | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-aws | 4.4.0-1054.58 | — |
| Ubuntu Pro 14.04 LTS | linux-lts-xenial | 4.4.0-164.192~14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | kernel-rt +12 | 4.18.0-80.11.1.rt9.156.el8_0 | RHSA-2019:2741 |
| RHEL 8 | perf +28 | 4.18.0-80.11.1.el8_0 | RHSA-2019:2703 |
| RHEL 7 | kernel-rt +10 | 3.10.0-1127.rt56.1093.el7 | RHSA-2020:1070 |
| RHEL 7 | perf +18 | 3.10.0-1127.el7 | RHSA-2020:1016 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.7 EUS | perf +18 | 3.10.0-1062.26.1.el7 | RHSA-2020:2522 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | kernel-docs +5 | 4.12.14-197.4.1 | SUSE-SU-2019:1550-1 |
| SLES 15 | kernel-azure +2 | 4.12.14-5.27.1 | SUSE-SU-2019:1240-1 |
| SLES 15 | kernel-docs +6 | 4.12.14-150.17.1 | SUSE-SU-2019:1244-1 |
| SLES 12 SP4 | kernel-azure +2 | 4.12.14-6.12.1 | SUSE-SU-2019:1242-1 |
| SLES 12 SP4 | kernel-docs +4 | 4.12.14-95.16.1 | SUSE-SU-2019:1241-1 |
| SLES 12 SP3 | kernel-docs +1 | 4.4.178-94.91.2 | SUSE-SU-2019:1245-1 |
| SLES 12 SP3 | kernel-syms +2 | 4.4.178-94.91.1 | SUSE-SU-2019:1245-1 |
| SLES 12 SP2 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SLES 12 SP2 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | kernel-xen +3 | 3.12.74-60.64.110.1 | SUSE-SU-2019:1289-1 |
| SLES 12 SP1 | kgraft-patch-SLE12-SP1_Update_33 | 1-2.3.1 | SUSE-SU-2019:1289-1 |
| SLES 12 SP1 | lttng-modules | 2.7.0-4.4.1 | SUSE-SU-2019:1289-1 |
| SLES 12 | kernel-ec2 | 3.12.74-60.64.110.1 | SUSE-SU-2019:1289-1 |
| SLES for SAP 12 SP4 | kernel-azure +2 | 4.12.14-6.12.1 | SUSE-SU-2019:1242-1 |
| SLES for SAP 12 SP4 | kernel-syms +2 | 4.12.14-95.16.1 | SUSE-SU-2019:1241-1 |
| SLES for SAP 12 SP3 | kernel-default | 4.4.178-94.91.2 | SUSE-SU-2019:1245-1 |
| SLES for SAP 12 SP3 | kernel-syms +1 | 4.4.178-94.91.1 | SUSE-SU-2019:1245-1 |
| SLES for SAP 12 SP2 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SLES for SAP 12 SP2 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
| SLES for SAP 12 SP1 | kernel-xen +3 | 3.12.74-60.64.110.1 | SUSE-SU-2019:1289-1 |
| SLES for SAP 12 SP1 | kgraft-patch-SLE12-SP1_Update_33 | 1-2.3.1 | SUSE-SU-2019:1289-1 |
| SLES for SAP 12 SP1 | lttng-modules | 2.7.0-4.4.1 | SUSE-SU-2019:1289-1 |
| SLE Live Patching 15 SP1 | kernel-default | 4.12.14-197.4.1 | SUSE-SU-2019:1550-1 |
| SLE Live Patching 15 SP1 | kernel-livepatch-SLE15-SP1_Update_1 | 1-3.3.1 | SUSE-SU-2019:1550-1 |
| SLE Live Patching 15 | kernel-default | 4.12.14-150.17.1 | SUSE-SU-2019:1244-1 |
| SLE Live Patching 15 | kernel-livepatch-SLE15_Update_10 | 1-1.3.1 | SUSE-SU-2019:1244-1 |
| SLE Live Patching 12 SP4 | kgraft-patch-SLE12-SP4_Update_4 | 1-6.3.1 | SUSE-SU-2019:1241-1 |
| SLE Live Patching 12 SP3 | kgraft-patch-SLE12-SP3_Update_25 | 1-4.3.1 | SUSE-SU-2019:1245-1 |
| SUSE Real Time Module 15 SP1 | kernel-rt +3 | 4.12.14-14.8.1 | SUSE-SU-2019:2430-1 |
| SUSE OpenStack Cloud 7 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SUSE OpenStack Cloud 7 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
| SUSE Enterprise Storage 4 | kernel-syms +2 | 4.4.121-92.109.2 | SUSE-SU-2019:1287-1 |
| SUSE Enterprise Storage 4 | kgraft-patch-SLE12-SP2_Update_29 | 1-3.5.2 | SUSE-SU-2019:1287-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | kernel-docs +8 | 4.12.14-lp151.28.4.1 | openSUSE-SU-2019:1479-1 |
| openSUSE Leap 15.0 | kernel-docs +8 | 4.12.14-lp150.12.61.1 | openSUSE-SU-2019:1404-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | perf +19 | 4.18.0-80.11.1.el8_0 | ELSA-2019-2703 |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.45.1.el6uek | 0.4.5-3.el6 | ELSA-2020-5671 |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.45.1.el7uek | 0.4.5-3.el7 | ELSA-2020-5671 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-118.45.1.el7uek | ELSA-2020-5715, ELSA-2020-5671, ELSA-2020-5670 |
| Oracle Linux 7 | kernel-uek-tools +3 | 4.14.35-1902.303.4.1.el7uek | ELSA-2020-5715 |
| Oracle Linux 7 | perf +12 | 3.10.0-1127.el7 | ELSA-2020-5715, ELSA-2020-1016 |
Advisories 29
- USN-4095-1 linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Sep 7, 2026
- USN-4076-1 linux, linux-aws, linux-kvm, linux-raspi2 vulnerabilities Ubuntu Security Notices (USN) · Sep 7, 2026
- RHSA-2019:2741 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:2522 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2020:1070 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2020:1016 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2019:2703 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-3981-2 linux-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- USN-3981-1 linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- USN-3980-2 linux-hwe, linux-azure vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- DSA-4465-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1824-1 linux-4.9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1799-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:1242-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1287-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1289-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1241-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1479-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1245-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1550-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1240-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2430-1 Security update for kernel-source-rt SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1244-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1404-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2020-5715 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 9, 2020
- ELSA-2020-5671 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 7, 2020
- ELSA-2020-5670 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 6, 2020
- ELSA-2020-1016 Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 6, 2020
- ELSA-2019-2703 Important: kernel security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 12, 2019
References
- https://blog.quarkslab.com/reverse-engineering-broadcom-wireless-chipsets.html
- https://kb.cert.org/vuls/id/166939/
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4176ec356c73a46c07c181c6d04039fafa34a9f
- https://bugzilla.redhat.com/show_bug.cgi?id=1701842
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-9503.html
- https://bugzilla.suse.com/show_bug.cgi?id=1132828
- https://security-tracker.debian.org/tracker/CVE-2019-9503