CVE-2026-68403

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: initialize SDIO data work before cleanup

brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before

allocating the ordered workqueue. If that allocation fails, the function

jumps to fail and calls brcmf_sdio_remove().

brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the

work item before the first failure path that can reach brcmf_sdio_remove(),

so the cleanup path always observes a valid work object.

This issue was found by our static analysis tool and then confirmed by

manual review of the probe error path and the remove-time work drain. The

problem pattern is an early setup failure that reaches a cleanup helper

which cancels an embedded work item before its initializer has run.

A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in

brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The

resulting fail path calls brcmf_sdio_remove()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References