CVE-2025-21750: wifi: brcmfmac: Check the return value of of_property_read_string_index()

Published Feb 27, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: Check the return value of ofpropertyreadstringindex()

Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random pointer to devmkstrdup().

The crash I am getting looks like this:

BUG: unable to handle page fault for address: 00007f033c669379 PF: supervisor read access in kernel mode PF: errorcode(0x0001) - permissions violation PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 Oops: Oops: 0001 [#1] SMP PTI CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 RIP: 0010:strlen+0x4/0x30 Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379 RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30 FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? die+0x23/0x70 ? pagefaultoops+0x149/0x4c0 ? rawspinrqlocknested+0xe/0x20 ? schedbalancenewidle+0x22b/0x3c0 ? updateloadavg+0x78/0x770 ? excpagefault+0x6f/0x150 ? asmexcpagefault+0x26/0x30 ? pfxpciconf1write+0x10/0x10 ? strlen+0x4/0x30 devmkstrdup+0x25/0x70 brcmfofprobe+0x273/0x350 [brcmfmac]

Affected Software

169 affected componentsFixes available
Linux Kernel>=6.10<6.11
Microsoft cbl2 kernel 5.15.186.1-1
Linux Linux kernel<6.1.129
Linux Linux kernel>=6.2<6.6.78
Linux Linux kernel>=6.7<6.12.14
Linux Linux kernel>=6.13<6.13.3
debian/linux<6.1.129-1
6.1.129-1
debian/linux<6.12.15-1
6.12.15-1
debian/linux<6.12.15-1
6.12.15-1
linux/kernel>=5.9.0<6.1.129
6.1.129
linux/kernel>=6.2.0<6.6.78
6.6.78
linux/kernel>=6.7.0<6.12.14
6.12.14
linux/kernel>=6.13.0<6.13.3
6.13.3
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.15-1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.15*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15*
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm-5.15*
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15*
ubuntu/linux-lowlatency-hwe-5.15*
ubuntu/linux-nvidia-tegra-5.15*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15*
ubuntu/linux-riscv-5.8*
ubuntu/linux*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1032.34~22.04.1
6.8.0-1032.34~22.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1034.39~22.04.1
6.8.0-1034.39~22.04.1
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1033.35~22.04.1
6.8.0-1033.35~22.04.1
ubuntu/linux-gke*
ubuntu/linux-gkeop*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-64.67~22.04.1
6.8.0-64.67~22.04.1
ubuntu/linux-ibm*
ubuntu/linux-ibm-6.8<6.8.0-1029.29~22.04.1
6.8.0-1029.29~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg*
ubuntu/linux-kvm*
ubuntu/linux-lowlatency*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-64.67.1~22.04.1
6.8.0-64.67.1~22.04.1
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1031.34~22.04.1
6.8.0-1031.34~22.04.1
ubuntu/linux-nvidia-tegra*
ubuntu/linux-nvidia-tegra-igx*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1029.30~22.04.1
6.8.0-1029.30~22.04.1
ubuntu/linux-raspi*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-64.67~22.04.1
6.8.0-64.67~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp*
ubuntu/linux-bluefield*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-realtime*
ubuntu/linux-realtime-6.8<6.8.1-1025.26~22.04.1
6.8.1-1025.26~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<6.8.0-64.67
6.8.0-64.67
ubuntu/linux-aws<6.8.0-1032.34
6.8.0-1032.34
ubuntu/linux-azure<6.8.0-1034.39
6.8.0-1034.39
ubuntu/linux-azure-6.11<6.11.0-1015.15~24.04.1
6.11.0-1015.15~24.04.1
ubuntu/linux-azure-nvidia<6.8.0-1022.23
6.8.0-1022.23
ubuntu/linux-gcp<6.8.0-1033.35
6.8.0-1033.35
ubuntu/linux-gcp-6.11<6.11.0-1015.15~24.04.1
6.11.0-1015.15~24.04.1
ubuntu/linux-gke<6.8.0-1028.32
6.8.0-1028.32
ubuntu/linux-gkeop<6.8.0-1015.17
6.8.0-1015.17
ubuntu/linux-hwe-6.11<6.11.0-26.26~24.04.1
6.11.0-26.26~24.04.1
ubuntu/linux-ibm<6.8.0-1029.29
6.8.0-1029.29
ubuntu/linux-lowlatency<6.8.0-64.67.1
6.8.0-64.67.1
ubuntu/linux-lowlatency-hwe-6.11<6.11.0-1014.15~24.04.1
6.11.0-1014.15~24.04.1
ubuntu/linux-nvidia<6.8.0-1031.34
6.8.0-1031.34
ubuntu/linux-nvidia-6.11<6.11.0-1010.10
6.11.0-1010.10
ubuntu/linux-nvidia-lowlatency<6.8.0-1031.34.1
6.8.0-1031.34.1
ubuntu/linux-nvidia-tegra<6.8.0-1008.8
6.8.0-1008.8
ubuntu/linux-oem-6.11<6.11.0-1022.22
6.11.0-1022.22
ubuntu/linux-oem-6.8<6.8.0-1031.31
6.8.0-1031.31
ubuntu/linux-oracle<6.8.0-1029.30
6.8.0-1029.30
ubuntu/linux-raspi<6.8.0-1031.35
6.8.0-1031.35
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-xilinx<6.8.0-1017.18
6.8.0-1017.18
ubuntu/linux-raspi-realtime<6.8.0-2026.27
6.8.0-2026.27
ubuntu/linux-realtime<6.8.1-1025.26
6.8.1-1025.26
ubuntu/linux-fips<6.8.0-78.78+fips1
6.8.0-78.78+fips1
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.129-1
  2. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.12.15-1
  3. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1032.34~22.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1034.39~22.04.1
  5. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.35~22.04.1
  6. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-64.67~22.04.1
  7. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.29~22.04.1
  8. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-64.67.1~22.04.1
  9. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1031.34~22.04.1
  10. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.30~22.04.1
  11. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-64.67~22.04.1
  12. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1025.26~22.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-64.67
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1032.34
  15. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1034.39
  16. Upgrade

    Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1015.15~24.04.1
  17. Upgrade

    Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1022.23
  18. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.35
  19. Upgrade

    Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1015.15~24.04.1
  20. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.32
  21. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1015.17
  22. Upgrade

    Upgrade ubuntu/linux-hwe-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-26.26~24.04.1
  23. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.29
  24. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-64.67.1
  25. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1014.15~24.04.1
  26. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1031.34
  27. Upgrade

    Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1010.10
  28. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1031.34.1
  29. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.8
  30. Upgrade

    Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.

    Fixed in 6.11.0-1022.22
  31. Upgrade

    Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1031.31
  32. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1029.30
  33. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1031.35
  34. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1017.18
  35. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2026.27
  36. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1025.26
  37. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-78.78+fips1
  38. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.1.129
  39. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.6.78
  40. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.12.14
  41. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.13.3
  42. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1
  43. Compensating control

    In the brcmfmac driver, check the return value of of_property_read_string_index() before passing the temporary string pointer to devm_kstrdup(); handle the missing-property case so an uninitialized pointer is not used.

Event History

Feb 27, 2025
CVE Published
via MITRE·02:12 AM
Data Sourced
via MITRE·02:12 AM
Description
Data Sourced
via OSV·02:12 AM
DescriptionAffected Software
Data Sourced
via Red Hat·03:06 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·03:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 30, 2025
Data Sourced
via Microsoft·01:01 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·01:01 AM
Affected Software
Nov 11, 2026
Data Sourced
via OSV·09:38 AM
Severity

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2025-21750?

The severity of CVE-2025-21750 has not been explicitly rated, but it affects the Linux kernel driver and can cause system crashes.

2

How do I fix CVE-2025-21750?

To fix CVE-2025-21750, upgrade to a version of the Linux kernel later than 6.11 where the vulnerability has been resolved.

3

Which versions of the Linux kernel are affected by CVE-2025-21750?

CVE-2025-21750 affects Linux kernel versions between 6.10 and 6.11.

4

What component of the Linux kernel is impacted by CVE-2025-21750?

CVE-2025-21750 impacts the brcmfmac driver within the Linux kernel that handles Wi-Fi connectivity.

5

What type of issue is CVE-2025-21750 classified as?

CVE-2025-21750 is classified as a driver vulnerability which can lead to system instability and crashes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203