CVE-2026-98350: wifi: brcmfmac: cyw: pass PMKID to firmware if present
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: cyw: pass PMKID to firmware if present
Zero out authstatus on initialization. Otherwise, garbage will leak from the stack to the firmware (when ssid is less than 32 bytes and/or when params->pmkid is set). Then, pass the params->pmkid to the firmware (without it, the firmware caches a garbage PMKID on successful authentication and denies a subsequent association request that includes the PMKID).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel brcmfmac CYW authentication path, zero out auth_status during initialization and pass params->pmkid to the firmware when present.
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Systems using the Linux kernel's brcmfmac CYW Wi-Fi driver are relevant. The issue occurs during Wi-Fi authentication when firmware receives uninitialized authentication-status data or does not receive a supplied PMKID.
What symptoms could indicate that a system is affected?
A successful authentication may be followed by a denied association request when that later request includes a PMKID. This can occur because the firmware cached a garbage PMKID during the earlier authentication.
What conditions trigger the uninitialized data being sent to firmware?
The description identifies authentication attempts where the SSID is shorter than 32 bytes and/or where params->pmkid is set. In those cases, uninitialized stack data can be leaked to the firmware if auth_status is not zeroed.
What does the fix change?
The fix zeroes auth_status during initialization and passes params->pmkid to the firmware when it is present. This prevents firmware from caching a garbage PMKID and allows subsequent association requests containing that PMKID.