CVE-2025-39863

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

The brcmf_btcoex_detach() only shuts down the btcoex timer, if the

flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which

runs as timer handler, sets timer_on to false. This creates critical

race conditions:

1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()

is executing, it may observe timer_on as false and skip the call to

timer_shutdown_sync().

2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info

worker after the cancel_work_sync() has been executed, resulting in

use-after-free bugs.

The use-after-free bugs occur in two distinct scenarios, depending on

the timing of when the brcmf_btcoex_info struct is freed relative to

the execution of its worker thread.

Scenario 1: Freed before the worker is scheduled

The brcmf_btcoex_info is deallocated before the worker is scheduled.

A race condit

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References