CVE-2026-53093

wifi: brcmfmac: Fix error pointer dereference

MEDIUM

5.5

CVSS Score

Published: June 24, 2026 at 04:30 PM UTC

Updated: July 23, 2026 at 07:32 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix error pointer dereference The function brcmf_chip_add_core() can return an error pointer and is not checked. Add checks for error pointer. Detected by Smatch: drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error: 'core' dereferencing possible ERR_PTR() [add missing wifi: prefix]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.15 ≤ v < 5.10.2583.15 ≤ v < 5.15.2093.15 ≤ v < 6.1.1753.15 ≤ v < 6.12.913.15 ≤ v < 6.18.333.15 ≤ v < 6.6.1413.15 ≤ v < 7.0.103.15 ≤ v < 7.15.11 ≤ v < 5.15.2095.16 ≤ v < 6.1.1756.13 ≤ v < 6.18.336.19 ≤ v < 7.0.106.2 ≤ v < 6.6.1416.7 ≤ v < 6.12.913.15cb7cf7be9eba76f3cd6258906074c72084570c84

Vendor states this is fixed in 2e0e5a43ed126f896a4ad31ade66c90270601bae (fixed)

Vendor states this is fixed in 334c68750eee84c2327db1d152be83ff5ad8e20b (fixed)

Vendor states this is fixed in 99ef547659178eef6d6ba4738a9d989ce90cf909 (fixed)

Vendor states this is fixed in a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af (fixed)

Vendor states this is fixed in bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d (fixed)

Vendor states this is fixed in cbea71b4480394708f9a6e007a0385acfe5e1ec8 (fixed)

Vendor states this is fixed in d3f280be48f1c672cb10e8026c236d0cca60048a (fixed)

Vendor states this is fixed in dd8592fc6007a451c3e4b9025de365e39de8178a (fixed)

Vendor states this is fixed in 3.15 (unaffected)

Vendor states this is fixed in 5.10.258 (unaffected)

Vendor states this is fixed in 5.15.209 (unaffected)

Vendor states this is fixed in 6.1.175 (unaffected)