{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "9831bcb987df4aff6a1d85975f1dda4c654f298d"
            },
            {
              "fixed": "75e917473e20dea61f837f9afb5fc3435c9200d2"
            },
            {
              "fixed": "c4c0659eb74f807e0e73742b101a07b0bb703d97"
            },
            {
              "fixed": "0f84eec09039deb9229fd35c55912a2397d3ae55"
            },
            {
              "fixed": "7b79131e357c4786765b20a994ad40d4d35f2163"
            },
            {
              "fixed": "2e0c8c60a11b3177e7432c71d41249e276a0825f"
            },
            {
              "fixed": "eef16a74ff8ed2a838d6bb862bb2c7783fce7466"
            },
            {
              "fixed": "47ca6395a1d91545cc9403f9218bc61be941a0c3"
            },
            {
              "fixed": "08a3f02fea636e97a7422d1512f76dacdb5b0887"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.4.0"
            },
            {
              "fixed": "5.10.273"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.224"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.191"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.160"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.113"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.57"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99061.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n   device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n   calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n   1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n   which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n   and calls brcmf_remove_interface(ifp, false) for the same ifp.\n   brcmf_p2p_ifp_removed() reads ifp-\u003evif and then blocks on\n   rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n   cfg80211_unregister_wdev() on the wdev that was already unregistered\n   and freed.\n\nThe second list_del_rcu() of wdev-\u003elist faults on LIST_POISON2:\n\n  brcmfmac: brcmf_p2p_del_vif delete P2P vif\n  brcmfmac: brcmf_p2p_deinit_discovery enter\n  brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n  brcmfmac: brcmf_detach Enter\n  brcmfmac: brcmf_bus_change_state 1 -\u003e 0\n  brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n  [1.5 s later, brcmf_p2p_del_vif() timed out]\n  brcmfmac: brcmf_remove_interface Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_del_if Enter, bsscfgidx=1, ifidx=0\n  brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n  Unable to handle kernel paging request at virtual address dead000000000122\n  Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n  pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n  Call trace:\n   _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n   cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n   brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n   brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n   brcmf_detach+0x88/0x180 [brcmfmac]\n   brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n   brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n   brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n   sdio_bus_remove+0x38/0x144\n   device_release_driver_internal+0x1e8/0x2c0\n   device_release_driver+0x14/0x20\n   brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n   brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n   __exit_compat+0x18/0x418 [brcmfmac_cyw]\n   __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug=0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n  1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n     P2P device (iw dev shows \"type P2P-device\").\n  2. Stop wpa_supplicant and remove the driver without waiting for\n     wpa_supplicant to exit:\n\n       kill $(pidof wpa_supplicant)\n       rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked=true. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface.",
  "id": "CVE-2026-99061",
  "modified": "2026-11-01T02:30:23.830383795Z",
  "published": "2026-10-23T12:22:59.770Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/08a3f02fea636e97a7422d1512f76dacdb5b0887"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0f84eec09039deb9229fd35c55912a2397d3ae55"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2e0c8c60a11b3177e7432c71d41249e276a0825f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/47ca6395a1d91545cc9403f9218bc61be941a0c3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/75e917473e20dea61f837f9afb5fc3435c9200d2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7b79131e357c4786765b20a994ad40d4d35f2163"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c4c0659eb74f807e0e73742b101a07b0bb703d97"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eef16a74ff8ed2a838d6bb862bb2c7783fce7466"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99061.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99061"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()"
}