{ "cveId": "CVE-2026-99061", "url": "https://patchblox.com/security/cve/CVE-2026-99061", "summary": "CVE-2026-99061 is fixed in 11 products on 1 platform, first by DEBIAN-CVE-2026-99061, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()", "description": "In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device interface is removed twice and the kernel crashes. The two paths are: - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P device. nl80211_del_interface() holds RTNL and the wiphy mutex and calls brcmf_p2p_del_vif(), which disables discovery and waits up to 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(), which unregisters the wdev and frees the vif and the ifp. - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives, and calls brcmf_remove_interface(ifp, false) for the same ifp. brcmf_p2p_ifp_removed() reads ifp-\u003Evif and then blocks on rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls cfg80211_unregister_wdev() on the wdev that was already unregistered and freed. The second list_del_rcu() of wdev-\u003Elist faults on LIST_POISON2: brcmfmac: brcmf_p2p_del_vif delete P2P vif brcmfmac: brcmf_p2p_deinit_discovery enter brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared brcmfmac: brcmf_detach Enter brcmfmac: brcmf_bus_change_state 1 -\u003E 0 brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed [1.5 s later, brcmf_p2p_del_vif() timed out] brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0 brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed Unable to handle kernel paging request at virtual address dead000000000122 Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP pc : _cfg80211_unregister_wdev\u002B0x6c/0x264 [cfg80211] Call trace: _cfg80211_unregister_wdev\u002B0x6c/0x264 [cfg80211] cfg80211_unregister_wdev\u002B0x10/0x1c [cfg80211] brcmf_p2p_ifp_removed\u002B0x84/0xb0 [brcmfmac] brcmf_remove_interface\u002B0x1f4/0x254 [brcmfmac] brcmf_detach\u002B0x88/0x180 [brcmfmac] brcmf_sdio_remove\u002B0x90/0x7b0 [brcmfmac] brcmf_sdiod_remove\u002B0x20/0xa0 [brcmfmac] brcmf_ops_sdio_remove\u002B0xbc/0x12c [brcmfmac] sdio_bus_remove\u002B0x38/0x144 device_release_driver_internal\u002B0x1e8/0x2c0 device_release_driver\u002B0x14/0x20 brcmf_sdio_bus_remove\u002B0x2c/0x40 [brcmfmac] brcmf_fwvid_unregister_vendor\u002B0xd8/0x170 [brcmfmac] __exit_compat\u002B0x18/0x418 [brcmfmac_cyw] __arm64_sys_delete_module\u002B0x1ac/0x244 The log was taken with debug=0x406 on an i.MX 8M Plus board with a CYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of brcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same in mainline. To reproduce: 1. Start wpa_supplicant on wlan0 and let it associate. It creates the P2P device (iw dev shows \u0022type P2P-device\u0022). 2. Stop wpa_supplicant and remove the driver without waiting for wpa_supplicant to exit: kill $(pidof wpa_supplicant) rmmod brcmfmac_cyw brcmfmac The crash is reproducible on that board. For the interface without a netdev (the P2P device), take RTNL and the wiphy mutex in brcmf_detach() before reading iflist, and remove it with locked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the slot empty. If brcmf_detach() runs first, nl80211 does not find the wdev any more. The interfaces with a netdev are removed as before, because brcmf_del_if() takes RTNL on its own for the primary interface.", "published": "2026-10-23T13:17:29Z", "severity": "Moderate", "cvss": 4.1, "epss": 0.00177, "epssPercentile": 0.07329, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99061", "fixes": [ { "platform": "linux", "product": "kernel-64kb", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1.150700.17.51.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7_Update_24", "release": "sles 15.7", "fixedVersion": "1-150700.15.3.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.90.1", "fix": "SUSE-SU-2026:5091-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-5091-1", "released": "2026-11-07T00:43:02Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.113-1", "fix": "DEBIAN-CVE-2026-99061", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99061", "released": "2026-10-24T13:25:57Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.11-1", "fix": "DEBIAN-CVE-2026-99061", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99061", "released": "2026-10-24T13:25:57Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }