Linux kernel (brcmfmac) vulnerabilities

In the Linux kernel, the brcmfmac driver has a race condition when removing a P2P device during driver detach. If the driver is removed while the userspace process that created the P2P device (e.g., wpa_supplicant) is still exiting, the P2P interface is removed twice, causing a kernel crash (oops).

In the Linux kernel, the brcmfmac driver has a vulnerability where the bus_reset work item is not drained on device removal, leading to a use-after-free when the work callback runs after the drvr structure is freed.

In the Linux kernel, the brcmfmac (Broadcom WiFi) driver always uses the P2P vif to send Action frames. When only hostapd manages the wlan interface (standalone AP mode), the P2P interface is not initialized, causing a NULL pointer dereference and driver crash (kernel panic). The issue can be triggered remotely by sending an ANQP Query REQ Action frame even from an unassociated STA.