LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21750: wifi: brcmfmac: Check the return value of of_property_read_string_index()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the return value of of_property_read_string_index() Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random pointer to devm_kstrdup(). The crash I am getting looks like this: BUG: unable to handle page fault for address: 00007f033c669379 PF: supervisor read access in kernel mode PF: error_code(0x0001) - permissions violation PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 Oops: Oops: 0001 [#1] SMP PTI CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 RIP: 0010:strlen+0x4/0x30 Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379 RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30 FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x149/0x4c0 ? raw_spin_rq_lock_nested+0xe/0x20 ? sched_balance_newidle+0x22b/0x3c0 ? update_load_avg+0x78/0x770 ? exc_page_fault+0x6f/0x150 ? asm_exc_page_fault+0x26/0x30 ? __pfx_pci_conf1_write+0x10/0x10 ? strlen+0x4/0x30 devm_kstrdup+0x25/0x70 brcmf_of_probe+0x273/0x350 [brcmfmac]

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-21750 is a Linux kernel bug in the Broadcom brcmfmac Wi-Fi driver. On some systems, a missing device property can leave a pointer uninitialized and crash the kernel during driver probing. The provided evidence supports a reliability and availability concern, not confirmed data theft or remote compromise.

Executive priority

Schedule this through normal kernel patch management, with faster handling for systems where Wi-Fi driver crashes affect operations. There is no provided evidence of active exploitation or confidentiality impact, but kernel crashes can disrupt endpoints and embedded systems.

Technical view

brcmfmac failed to check of_property_read_string_index() before passing tmp to devm_kstrdup(). If the property is absent, tmp may contain an invalid pointer, causing a kernel page fault in strlen() during brcmf_of_probe(). The source reports this between Linux 6.10 and 6.11 on a MacBookPro14,3 and references stable kernel fixes.

Likely exposure

Exposure is most likely on Linux systems using the brcmfmac Broadcom Wi-Fi driver with affected kernel builds. The bundle lists Linux kernel versions as affected, but the flattened version data is incomplete. Prioritize laptops, embedded devices, and appliances with Broadcom Wi-Fi hardware.

Exploitation context

The bundle does not show CISA KEV listing, active exploitation, exploit code, or a remote attack path. The observed impact is a kernel crash when the driver encounters a missing property during probing. Treat exploitation status as unconfirmed and availability impact as the evidenced risk.

Researcher notes

The root cause is unchecked return handling for a device-tree property read. The affected-version data in the bundle appears lossy, so validate against upstream stable commits and distribution advisories rather than relying only on listed version strings. Avoid claiming exploitability beyond the reported crash path.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable brcmfmac fix.
  • Apply Debian LTS or distribution kernel updates where applicable.
  • Check vendor advisories before relying on any workaround.
  • Prioritize affected Broadcom Wi-Fi systems that crash during boot or device probing.

Validation and detection

  • Inventory Linux kernel versions and systems using the brcmfmac driver.
  • Check hardware inventory for Broadcom Wi-Fi devices.
  • Review kernel logs for Oops traces involving brcmf_of_probe, devm_kstrdup, or strlen.
  • Confirm the running kernel includes the relevant stable fix commit.
  • Track distribution advisories for patched package versions.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21750 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux29e354ebeeecaee979e6fe22cd6272682d7552c9, 29e354ebeeecaee979e6fe22cd6272682d7552c9, 29e354ebeeecaee979e6fe22cd6272682d7552c9, 29e354ebeeecaee979e6fe22cd6272682d7552c9, 29e354ebeeecaee979e6fe22cd6272682d7552c9unaffected
LinuxLinux5.9, 0, 6.1.129, 6.6.78, 6.12.14, 6.13.3, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.