CVE-2026-68192

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: make release_scratchbuffers idempotent

brcmf_pcie_release_scratchbuffers() frees the shared.scratch and

shared.ringupd DMA buffers with dma_free_coherent() but does not clear

the pointers afterwards, unlike the sibling release_ringbuffers() which

NULLs commonrings/flowrings/idxbuf on release.

Both the bus_reset .reset callback (brcmf_pcie_reset) and

brcmf_pcie_remove() call release_scratchbuffers. When reset teardown

has run before removal, remove's own teardown would call

dma_free_coherent() a second time on the already-freed DMA allocation.

NULL the pointers after free, matching release_ringbuffers(), so a later

release observes that the allocation has already been released. This

patch makes repeated sequential release safe; the reset-work lifetime is

handled separately by the following patch.

This issue was found by an in-house static analysis tool.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References