CVE-2026-53093
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix error pointer dereference
The function brcmf_chip_add_core() can return an error pointer and is
not checked. Add checks for error pointer.
Detected by Smatch:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
[add missing wifi: prefix]
Summary dbcve.org
In the brcmfmac wireless driver, the brcmf_chip_recognition() function calls brcmf_chip_add_core() which can return error pointers (e.g., ERR_PTR(-ENOMEM)). The returned pointer is dereferenced at five locations (lines 1010, 1013, 1016, 1019, 1022) without first checking if it's an error pointer using IS_ERR(), potentially causing a kernel null pointer dereference or undefined behavior when the function fails.
Mitigation
Apply the upstream kernel patch which adds IS_ERR() checks before dereferencing the core pointer returned by brcmf_chip_add_core(). This is a code-level fix requiring recompilation of the brcmfmac kernel module.