Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s Broadcom FullMAC Wi-Fi driver allows a firmware-supplied interface identifier to be used outside the intended array bounds. The published CVSS score is 8.8, indicating potentially severe confidentiality, integrity, and availability impact. Systems not using the brcmfmac driver are unlikely to be exposed.
Executive priority
Treat this as a high-priority patching issue for fleets using affected Broadcom Wi-Fi hardware, especially managed endpoints and embedded devices. First establish whether brcmfmac is present; systems without it should not receive the same urgency. No supplied evidence supports emergency incident-response measures for active exploitation.
Technical view
brcmf_fweh_handle_if_event() checks the firmware-provided interface index but did not similarly validate bsscfgidx before indexing drvr->iflist[]. A malformed IF event could therefore cause an out-of-bounds array access. The referenced stable-kernel changes reject events whose bsscfg index exceeds the interface array.
Likely exposure
Exposure is limited to Linux systems using the brcmfmac Broadcom FullMAC wireless driver and a vulnerable kernel build. The supplied version data spans multiple kernel series but is not sufficiently clear to establish precise vulnerable ranges. Distribution kernels may backport fixes, so version numbers alone are unreliable.
Exploitation context
The CVSS vector describes adjacent-network attack reach, low complexity, no privileges, and no user interaction. However, the supplied evidence provides no public exploit details or confirmed active exploitation, and the CVE is not listed as KEV.
Researcher notes
The vulnerable path trusts bsscfgidx independently of the already-validated interface index, creating an array-bounds failure in firmware event handling. No CWE was assigned in the supplied record. Precise affected and fixed ranges remain ambiguous; validate exposure by checking vendor backports or direct inclusion of the relevant stable commit.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable referenced stable-kernel fix.
- Prioritize wireless endpoints, appliances, and embedded Linux systems loading the brcmfmac driver.
- Consult distribution or device-vendor guidance because backports can make kernel version comparisons misleading.
- Apply normal network and endpoint monitoring while updates are tested and deployed.
Validation and detection
- Inventory systems for loaded or packaged brcmfmac kernel modules and Broadcom FullMAC wireless hardware.
- Map each running kernel build to its distribution or device-vendor security advisory.
- Verify the vendor kernel includes the applicable referenced bsscfgidx validation change.
- After updating, confirm systems boot normally and wireless interfaces connect without driver errors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43110 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54CVE reference, Linux
- https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734CVE reference, Linux
- https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579cCVE reference, Linux
- https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6CVE reference, Linux
- https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8eCVE reference, Linux
- https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52dCVE reference, Linux
- https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bbCVE reference, Linux
- https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.