{"id":"CVE-2025-39863","state":"PUBLISHED","title":"wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\n\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\nruns as timer handler, sets timer_on to false. This creates critical\nrace conditions:\n\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\nis executing, it may observe timer_on as false and skip the call to\ntimer_shutdown_sync().\n\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\nworker after the cancel_work_sync() has been executed, resulting in\nuse-after-free bugs.\n\nThe use-after-free bugs occur in two distinct scenarios, depending on\nthe timing of when the brcmf_btcoex_info struct is freed relative to\nthe execution of its worker thread.\n\nScenario 1: Freed before the worker is scheduled\n\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\nA race condition can occur when schedule_work(&bt_local->work) is\ncalled after the target memory has been freed. The sequence of events\nis detailed below:\n\nCPU0                           | CPU1\nbrcmf_btcoex_detach            | brcmf_btcoex_timerfunc\n                               |   bt_local->timer_on = false;\n  if (cfg->btcoex->timer_on)   |\n    ...                        |\n  cancel_work_sync();          |\n  ...                          |\n  kfree(cfg->btcoex); // FREE  |\n                               |   schedule_work(&bt_local->work); // USE\n\nScenario 2: Freed after the worker is scheduled\n\nThe brcmf_btcoex_info is freed after the worker has been scheduled\nbut before or during its execution. In this case, statements within\nthe brcmf_btcoex_handler() — such as the container_of macro and\nsubsequent dereferences of the brcmf_btcoex_info object will cause\na use-after-free access. The following timeline illustrates this\nscenario:\n\nCPU0                            | CPU1\nbrcmf_btcoex_detach             | brcmf_btcoex_timerfunc\n                                |   bt_local->timer_on = false;\n  if (cfg->btcoex->timer_on)    |\n    ...                         |\n  cancel_work_sync();           |\n  ...                           |   schedule_work(); // Reschedule\n                                |\n  kfree(cfg->btcoex); // FREE   |   brcmf_btcoex_handler() // Worker\n  /*                            |     btci = container_of(....); // USE\n   The kfree() above could      |     ...\n   also occur at any point      |     btci-> // USE\n   during the worker's execution|\n   */                           |\n\nTo resolve the race conditions, drop the conditional check and call\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\nregardless of its current state. Once stopped, the timer_on state is\nthen set to false.","publishedAt":"2025-09-19T15:26:33.069Z","updatedAt":"2026-10-15T01:08:30.419Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"c75600e69e66a751cc046cd9c407b942f298d852","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"ae58f70bde0433f27ef4b388ab50634736607bf6","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"f1150153c4e5940fe49ab51136343c5b4fe49d63","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"3e789f8475f6c857c88de5c5bf4b24b11a477dd7","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"2f6fbc8e04ca1d1d5c560be694199f847229c625","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"9cb83d4be0b9b697eae93d321e0da999f9cdfcfc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.10","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.105","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.6","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c"]}],"references":["https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852","https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6","https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63","https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7","https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625","https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39863.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39863","state":"PUBLISHED","datePublished":"2025-09-19T15:26:33.069Z","dateUpdated":"2026-10-15T01:08:30.419Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.143Z"},"containers":{"cna":{"title":"wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work\n\nThe brcmf_btcoex_detach() only shuts down the btcoex timer, if the\nflag timer_on is false. However, the brcmf_btcoex_timerfunc(), which\nruns as timer handler, sets timer_on to false. This creates critical\nrace conditions:\n\n1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()\nis executing, it may observe timer_on as false and skip the call to\ntimer_shutdown_sync().\n\n2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info\nworker after the cancel_work_sync() has been executed, resulting in\nuse-after-free bugs.\n\nThe use-after-free bugs occur in two distinct scenarios, depending on\nthe timing of when the brcmf_btcoex_info struct is freed relative to\nthe execution of its worker thread.\n\nScenario 1: Freed before the worker is scheduled\n\nThe brcmf_btcoex_info is deallocated before the worker is scheduled.\nA race condition can occur when schedule_work(&bt_local->work) is\ncalled after the target memory has been freed. The sequence of events\nis detailed below:\n\nCPU0                           | CPU1\nbrcmf_btcoex_detach            | brcmf_btcoex_timerfunc\n                               |   bt_local->timer_on = false;\n  if (cfg->btcoex->timer_on)   |\n    ...                        |\n  cancel_work_sync();          |\n  ...                          |\n  kfree(cfg->btcoex); // FREE  |\n                               |   schedule_work(&bt_local->work); // USE\n\nScenario 2: Freed after the worker is scheduled\n\nThe brcmf_btcoex_info is freed after the worker has been scheduled\nbut before or during its execution. In this case, statements within\nthe brcmf_btcoex_handler() — such as the container_of macro and\nsubsequent dereferences of the brcmf_btcoex_info object will cause\na use-after-free access. The following timeline illustrates this\nscenario:\n\nCPU0                            | CPU1\nbrcmf_btcoex_detach             | brcmf_btcoex_timerfunc\n                                |   bt_local->timer_on = false;\n  if (cfg->btcoex->timer_on)    |\n    ...                         |\n  cancel_work_sync();           |\n  ...                           |   schedule_work(); // Reschedule\n                                |\n  kfree(cfg->btcoex); // FREE   |   brcmf_btcoex_handler() // Worker\n  /*                            |     btci = container_of(....); // USE\n   The kfree() above could      |     ...\n   also occur at any point      |     btci-> // USE\n   during the worker's execution|\n   */                           |\n\nTo resolve the race conditions, drop the conditional check and call\ntimer_shutdown_sync() directly. It can deactivate the timer reliably,\nregardless of its current state. Once stopped, the timer_on state is\nthen set to false."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"c75600e69e66a751cc046cd9c407b942f298d852","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"ae58f70bde0433f27ef4b388ab50634736607bf6","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"f1150153c4e5940fe49ab51136343c5b4fe49d63","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"3e789f8475f6c857c88de5c5bf4b24b11a477dd7","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"2f6fbc8e04ca1d1d5c560be694199f847229c625","versionType":"git"},{"version":"61730d4dfffc2cc9d3a49fad87633008105c18ba","status":"affected","lessThan":"9cb83d4be0b9b697eae93d321e0da999f9cdfcfc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.10","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.167","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.105","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.46","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.6","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852"},{"url":"https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6"},{"url":"https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63"},{"url":"https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7"},{"url":"https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625"},{"url":"https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The race is armed through a local nl80211/netlink command (NL80211_CMD_CRIT_PROTOCOL_START) on the local wireless device and freed through a local driver teardown/bus-reset path; no remote or adjacent-network frame reaches `brcmf_btcoex_detach()` or arms the btcoex timer directly. Although an adjacent attacker can induce the free side by halting the firmware (`BRCMF_D2H_DEV_FWHALT` → `brcmf_fw_crashed()` → `brcmf_bus_reset()`), a single attacker capable of both halves of the race operates locally.\nAC:L - The attacker controls both sides: the crit-proto `duration` makes the handler arm the timer at a deterministic `jiffies + 2s`, so the callback's execution moment is known in advance, and the same actor drives the teardown (bus reset / driver unbind / firmware halt) to land inside it. The attempt is cheap to repeat in a loop until the window is hit, and the freed `kmalloc-192` object can be sprayed with standard heap-grooming syscalls.\nPR:L - `NL80211_CMD_CRIT_PROTOCOL_START` carries `GENL_UNS_ADMIN_PERM` (CAP_NET_ADMIN), which on Android and embedded targets is held by the confined non-root Wi-Fi/supplicant service account rather than by real root in the init namespace, and the free side can be reached without root by making the firmware halt. Basic account-level access with that delegated network capability is sufficient, so this is Low rather than High.\nUI:N - The attacker issues the crit-proto start and triggers the teardown itself; no victim needs to mount a filesystem, open a file, or take any other action for the use-after-free to occur.\nS:U - The freed object, the corrupted slab, and the hijacked workqueue dispatch all live within the kernel's own security authority, with no crossing into a hypervisor, IOMMU, or other protection domain.\nC:H - The use-after-free lets the attacker reoccupy the freed `brcmf_btcoex_info` slot, after which `brcmf_btcoex_handler()` dereferences attacker-chosen `btci->vif`, `btci->vif->ifp`, and `btci->cfg->pub` pointers, yielding an arbitrary kernel-memory read primitive and disclosure of kernel addresses.\nI:H - `process_one_work()` loads `work->func` out of the freed structure and calls it (`worker->current_func = work->func; worker->current_func(work);`), so a resprayed slot gives a controlled indirect call, and `schedule_work()` on freed memory additionally corrupts worker-pool list linkage — a full control-flow-hijack and arbitrary-write primitive.\nA:H - Even without successful grooming, scheduling and executing work on a kfree'd object dereferences poisoned/recycled memory and reliably produces a KASAN splat, oops, or kernel panic, taking the system down."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:05:43.455Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.1.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.6.105"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.12.46"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.16.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-39863","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-14T19:23:53.735650Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-14T19:33:11.612Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:08:30.419Z"},"x_adpType":"supplier"}]}}}