Linux Kernel NULL Pointer Dereference Vulnerability in brcmfmac Wi-Fi Driver

A NULL pointer dereference vulnerability has been identified in the Linux kernel's brcmfmac Wi-Fi driver. This issue arises when a device is removed or the kernel module is unloaded, potentially leading to a crash. The vulnerability occurs in the brcmf_txfinalize() function, where the driver attempts to update transmission statistics. If a specific condition is met, the function can receive a NULL pointer, causing a dereference error. While this vulnerability has primarily been observed when updating transmission statistics, it could potentially impact other areas where the pointer is used.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a kernel crash. However, the vulnerability could be exploited in a way that allows for arbitrary code execution, according to a reference.