CVE-2026-90345: wifi: brcmfmac: fix P2P action frame handling without device vif
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix P2P action frame handling without device vif
Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary interface, or when action-frame abort runs after the P2P device vif has not been created.
Fall back to the primary vif when aborting an action frame without a P2P device vif, and guard P2P device saved IE access before using it for peer channel search.
Event History
Frequently Asked Questions
What conditions trigger the vulnerable paths?
The issue can occur when userspace sends non-P2P public action frames through the primary interface, or when action-frame abort runs before the P2P device virtual interface has been created.
Is a P2P device virtual interface required for exposure?
No. The flaw specifically involves paths that incorrectly assume the P2P device vif exists when it may be absent.
What is the immediate mitigation if an update cannot be applied?
Avoid the affected action-frame scenarios: do not send non-P2P public action frames through the primary interface, and avoid action-frame abort handling when no P2P device vif has been created.