NULL Pointer Dereference Vulnerability in Linux Kernel WiFi Driver for Raspberry Pi by Broadcom

CVE-2025-40321

What is CVE-2025-40321?

A NULL pointer dereference vulnerability in the brcmfmac driver of the Linux kernel causes a crash during Action frame transmission in standalone AP mode. When managed by hostapd without P2P interfaces initialized, the driver attempts to send an Action frame using an uninitialized P2P vif pointer. This leads to a failure where the system cannot handle the dereference, resulting in a kernel crash. The issue is addressed by ensuring the correct vif corresponding to the wireless device is utilized for firmware communication, preventing such crashes during Action frame transmission.

References