High 8.8Published May 17, 2024

CVE-2024-35811wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach

Updated under an hour ago (Oct 27, 2026, 9:00 AM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before 202c503935042272e2f9e1bb549d5f69a8681169; from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before 8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1; from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before bacb8c3ab86dcd760c15903fcee58169bc3026aa; from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before 8c36205123dc57349b59b4f1a2301eb278cbc731; from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before 0b812f706fd7090be74812101114a0e165b36744; from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before 190794848e2b9d15de92d502b6ac652806904f5a; from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before 6678a1e7d896c00030b31491690e8ddc9a90767a; from e756af5b30b008f6ffcfebf8ad0b477f6f225b62 before 0a7591e14a8da794d0b93b5d1c6254ccb23adacb; and 1 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.7 before 4.19.312; from 4.20 before 5.4.274; from 5.5 before 5.10.215; from 5.11 before 5.15.154; from 5.16 before 6.1.84; from 6.2 before 6.6.24; from 6.7 before 6.7.12; from 6.8 before 6.8.3	NVD
debian debian_linux debian:debian_linux	10.0	NVD

References

References

https://git.kernel.org/stable/c/202c503935042272e2f9e1bb549d5f69a8681169	patch
https://git.kernel.org/stable/c/8e3f03f4ef7c36091f46e7349096efb5a2cdb3a1	patch
https://git.kernel.org/stable/c/bacb8c3ab86dcd760c15903fcee58169bc3026aa	patch
https://git.kernel.org/stable/c/8c36205123dc57349b59b4f1a2301eb278cbc731	patch
https://git.kernel.org/stable/c/0b812f706fd7090be74812101114a0e165b36744	patch
https://git.kernel.org/stable/c/190794848e2b9d15de92d502b6ac652806904f5a	patch
https://git.kernel.org/stable/c/6678a1e7d896c00030b31491690e8ddc9a90767a	patch
https://git.kernel.org/stable/c/0a7591e14a8da794d0b93b5d1c6254ccb23adacb	patch
https://git.kernel.org/stable/c/0f7352557a35ab7888bc7831411ec8a3cbe20d78	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html	mailing-list
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.