CVE-2019-9500: Broadcom Brcmfmac Driver

High severity, CVSS 8.3. EPSS: 3.9% chance of exploitation in the next 30 days.

The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

Affected products

• Broadcom Brcmfmac Driver: affected versions not specified
• Linux Linux Kernel: from 4.5, before 4.9.181 (fixed in 4.9.181); from 4.10, before 4.14.123 (fixed in 4.14.123); from 4.15, before 4.19.47 (fixed in 4.19.47); from 4.20, before 5.0.20 (fixed in 5.0.20)

Published 2020-01-16. Last modified 2026-06-17.