Uninitialized Variable Vulnerability in Linux Kernel: brcm80211 Package
Summary
CVE-2025-37990: In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() The function brcmf_usb_dl_writeimage() calls the function brcmf_usb_dl_cmd() but... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. The brcm80211 package is a driver for Broadcom's wireless chipsets, facilitating wireless communication. This package is crucial for enabling Wi-Fi connectivity on devices that utilize Broadcom hardware. However, it has been identified that the brcmf_usb_dl_writeimage() function within this package lacks proper error handling, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the function brcmf_usb_dl_writeimage() which calls brcmf_usb_dl_cmd() without checking its return value. If brcmf_usb_dl_cmd() fails, the variables 'state.state' and 'state.bytes' remain uninitialized. Utilizing these uninitialized variables can lead to unpredictable behavior, including system crashes or exploitation by malicious actors. This oversight poses a significant risk, particularly in environments where security is paramount.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described in the 'how_to_fix' section.
Conclusion
The CVE-2025-37990 vulnerability in the Linux kernel's brcm80211 package poses a significant risk due to uninitialized variables in the brcmf_usb_dl_writeimage() function. It is crucial to update the Linux package to the latest version to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37990 is a vulnerability in the Linux kernel's brcm80211 package that involves uninitialized variables leading to potential security risks.
If exploited, this vulnerability could lead to system instability or allow attackers to execute arbitrary code, compromising the security of the system.
Any version of the Linux kernel that includes the brcm80211 package is potentially affected. It is advisable to check for updates and apply them promptly.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json. It provides real-time alerts without requiring code access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by CVE-2025-37990 without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
