---
id: CVE-2026-72003
title: 'wifi: brcmfmac: cyw: fix heap overflow on a short auth frame'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

  brcmf_notify_auth_frame_rx() takes the frame length from the firmware
  event and copies the frame body with…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 66f909308a7c05082919ff214a0bbe2a76aa0283 <
    55b26abb1fa1ec406b3ad11b43c49c7624257565
  - >-
    Linux >= 66f909308a7c05082919ff214a0bbe2a76aa0283 <
    185bb156c427d0f865d344a6d0eaa02c6d05cc57
  - >-
    Linux >= 66f909308a7c05082919ff214a0bbe2a76aa0283 <
    240c8d2c717b3f8153e7e877b22a82518d78dbdc
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:49:45.460150Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:15.506Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72003'
references:
  - url: 'https://git.kernel.org/stable/c/55b26abb1fa1ec406b3ad11b43c49c7624257565'
  - url: 'https://git.kernel.org/stable/c/185bb156c427d0f865d344a6d0eaa02c6d05cc57'
  - url: 'https://git.kernel.org/stable/c/240c8d2c717b3f8153e7e877b22a82518d78dbdc'
tags:
  - cve.org
epss: 0.00349
epssPercentile: 0.2689
ingestedAt: '2026-10-16T17:24:46.871Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

brcmf_notify_auth_frame_rx() takes the frame length from the firmware
event and copies the frame body with the management header offset
subtracted:

	u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data);
	...
	memcpy(&mgmt_frame->u, frame,
	       mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));

The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len
can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When
mgmt_frame_len is below that, the subtraction wraps as an unsigned value to
a huge length. The memcpy then runs far past the kzalloc'd buffer. A
malicious or malfunctioning AP can make the frame short during the
external SAE auth exchange, so this is a remotely triggered heap overflow.

Reject frames shorter than the management header offset before the copy.

## Affected

- `Linux >= 66f909308a7c05082919ff214a0bbe2a76aa0283 < 55b26abb1fa1ec406b3ad11b43c49c7624257565`
- `Linux >= 66f909308a7c05082919ff214a0bbe2a76aa0283 < 185bb156c427d0f865d344a6d0eaa02c6d05cc57`
- `Linux >= 66f909308a7c05082919ff214a0bbe2a76aa0283 < 240c8d2c717b3f8153e7e877b22a82518d78dbdc`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.