CVE-2026-68192: wifi: brcmfmac: make release_scratchbuffers idempotent
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: make releasescratchbuffers idempotent
brcmfpciereleasescratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent() but does not clear the pointers afterwards, unlike the sibling releaseringbuffers() which NULLs commonrings/flowrings/idxbuf on release.
Both the busreset .reset callback (brcmfpciereset) and brcmfpcieremove() call releasescratchbuffers. When reset teardown has run before removal, remove's own teardown would call dmafreecoherent() a second time on the already-freed DMA allocation.
NULL the pointers after free, matching releaseringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (wifi: brcmfmac: make release_scratchbuffers idempotent)to a version that resolves this vulnerability.Patch wifi: brcmfmac: make release_scratchbuffers idempotent
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68192?
CVE-2026-68192 has a risk rating of 23, indicating a moderate severity vulnerability.
What does CVE-2026-68192 address?
CVE-2026-68192 addresses an issue in the Linux kernel's brcmfmac driver related to the idempotence of releasing DMA buffers.
How do I fix CVE-2026-68192?
To fix CVE-2026-68192, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What are the potential impacts of CVE-2026-68192?
CVE-2026-68192 could lead to potential memory corruption issues in systems relying on the affected brcmfmac driver.
Which systems are affected by CVE-2026-68192?
CVE-2026-68192 affects systems utilizing the Linux kernel with the brcmfmac wireless driver.