---
id: CVE-2025-39863
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

  The brcmf_btcoex_detach() only shuts down the btcoex timer, if the
  flag timer_on is false
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

  The brcmf_btcoex_detach() only shuts down the btcoex timer, if the
  flag timer_on is false. …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.10, < 6.6.105'
  - 'linux_kernel >= 6.7, < 6.12.46'
  - 'linux_kernel >= 6.13, < 6.16.6'
  - linux_kernel = 6.17
patched:
  - linux_kernel 6.16.6
published: '2025-09-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:02.107'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-39863'
references:
  - url: 'https://git.kernel.org/stable/c/2f6fbc8e04ca1d1d5c560be694199f847229c625'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3e789f8475f6c857c88de5c5bf4b24b11a477dd7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9cb83d4be0b9b697eae93d321e0da999f9cdfcfc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ae58f70bde0433f27ef4b388ab50634736607bf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c75600e69e66a751cc046cd9c407b942f298d852'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f1150153c4e5940fe49ab51136343c5b4fe49d63'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00162
epssPercentile: 0.05329
ingestedAt: '2026-10-15T03:30:12.821Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-01-14T19:23:53.735650Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work

The brcmf_btcoex_detach() only shuts down the btcoex timer, if the
flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which
runs as timer handler, sets timer_on to false. This creates critical
race conditions:

1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc()
is executing, it may observe timer_on as false and skip the call to
timer_shutdown_sync().

2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info
worker after the cancel_work_sync() has been executed, resulting in
use-after-free bugs.

The use-after-free bugs occur in two distinct scenarios, depending on
the timing of when the brcmf_btcoex_info struct is freed relative to
the execution of its worker thread.

Scenario 1: Freed before the worker is scheduled

The brcmf_btcoex_info is deallocated before the worker is scheduled.
A race condition can occur when schedule_work(&bt_local->work) is
called after the target memory has been freed. The sequence of events
is detailed below:

CPU0                           | CPU1
brcmf_btcoex_detach            | brcmf_btcoex_timerfunc
                               |   bt_local->timer_on = false;
  if (cfg->btcoex->timer_on)   |
    ...                        |
  cancel_work_sync();          |
  ...                          |
  kfree(cfg->btcoex); // FREE  |
                               |   schedule_work(&bt_local->work); // USE

Scenario 2: Freed after the worker is scheduled

The brcmf_btcoex_info is freed after the worker has been scheduled
but before or during its execution. In this case, statements within
the brcmf_btcoex_handler() — such as the container_of macro and
subsequent dereferences of the brcmf_btcoex_info object will cause
a use-after-free access. The following timeline illustrates this
scenario:

CPU0                            | CPU1
brcmf_btcoex_detach             | brcmf_btcoex_timerfunc
                                |   bt_local->timer_on = false;
  if (cfg->btcoex->timer_on)    |
    ...                         |
  cancel_work_sync();           |
  ...                           |   schedule_work(); // Reschedule
                                |
  kfree(cfg->btcoex); // FREE   |   brcmf_btcoex_handler() // Worker
  /*                            |     btci = container_of(....); // USE
   The kfree() above could      |     ...
   also occur at any point      |     btci-> // USE
   during the worker's execution|
   */                           |

To resolve the race conditions, drop the conditional check and call
timer_shutdown_sync() directly. It can deactivate the timer reliably,
regardless of its current state. Once stopped, the timer_on state is
then set to false.

## Affected

- `linux_kernel >= 3.10, < 6.6.105`
- `linux_kernel >= 6.7, < 6.12.46`
- `linux_kernel >= 6.13, < 6.16.6`
- `linux_kernel = 6.17`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.16.6`