CVE-2025-40321

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode

Currently, whenever there is a need to transmit an Action frame,

the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to

firmware. The P2P interfaces were available when wpa_supplicant is managing

the wlan interface.

However, the P2P interfaces are not created/initialized when only hostapd

is managing the wlan interface. And if hostapd receives an ANQP Query REQ

Action frame even from an un-associated STA, the brcmfmac driver tries

to use an uninitialized P2P vif pointer for sending the IOVAR to firmware.

This NULL pointer dereferencing triggers a driver crash.

[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual

address 0000000000000000

[...]

[ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)

[...]

[ 1417.075653] Call trace:

[ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References