{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: cyw: fix heap overflow on a short auth frame  brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted:  \tu32 mgmt_frame_len = e-\u003edatalen - sizeof(struct brcmf_rx_mgmt_data); \t... \tmemcpy(\u0026mgmt_frame-\u003eu, frame, \t       mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));  The only length check is e-\u003edatalen \u003e= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow.  Reject frames shorter than the management header offset before the copy.",
  "id": "DEBIAN-CVE-2026-72003",
  "modified": "2026-08-17T08:47:41.065220645Z",
  "published": "2026-08-15T06:20:53.557Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-72003"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-72003"
  ]
}