CVE-2026-72003: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

brcmf_notify_auth_frame_rx() takes the frame length from the firmware
event and copies the frame body with the management header offset
subtracted:

	u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data);
	...
	memcpy(&mgmt_frame->u, frame,
	       mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));

The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len
can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When
mgmt_frame_len is below that, the subtraction wraps as an unsigned value to
a huge length. The memcpy then runs far past the kzalloc'd buffer. A
malicious or malfunctioning AP can make the frame short during the
external SAE auth exchange, so this is a remotely triggered heap overflow.

Reject frames shorter than the management header offset before the copy.

The Linux kernel CVE team has assigned CVE-2026-72003 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.16 with commit 66f909308a7c05082919ff214a0bbe2a76aa0283 and fixed in 6.18.40 with commit 55b26abb1fa1ec406b3ad11b43c49c7624257565
	Issue introduced in 6.16 with commit 66f909308a7c05082919ff214a0bbe2a76aa0283 and fixed in 7.1.5 with commit 185bb156c427d0f865d344a6d0eaa02c6d05cc57
	Issue introduced in 6.16 with commit 66f909308a7c05082919ff214a0bbe2a76aa0283 and fixed in 7.2-rc4 with commit 240c8d2c717b3f8153e7e877b22a82518d78dbdc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72003
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/55b26abb1fa1ec406b3ad11b43c49c7624257565
	https://git.kernel.org/stable/c/185bb156c427d0f865d344a6d0eaa02c6d05cc57
	https://git.kernel.org/stable/c/240c8d2c717b3f8153e7e877b22a82518d78dbdc