CVE-2026-68192

Summary

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: make release_scratchbuffers idempotent

brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterwards, unlike the sibling release_ringbuffers() which NULLs commonrings/flowrings/idxbuf on release.

Both the bus_reset .reset callback (brcmf_pcie_reset) and brcmf_pcie_remove() call release_scratchbuffers. When reset teardown has run before removal, remove's own teardown would call dma_free_coherent() a second time on the already-freed DMA allocation.

NULL the pointers after free, matching release_ringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch.

This issue was found by an in-house static analysis tool.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux4684997d9eea29380000e062755aa6d368d789a3 < b7d1d8cb1bdca56aecebacd2896615da0acc126aaffected
LinuxLinux4684997d9eea29380000e062755aa6d368d789a3 < 5a045c2f0fbf029873d2295178fa0785ade35af0affected
LinuxLinux4684997d9eea29380000e062755aa6d368d789a3 < 044fca8f45ba9ab6ca526163155234cf88287ff5affected
LinuxLinux4684997d9eea29380000e062755aa6d368d789a3 < 0ca80328df23f851c86866720d4977783c919ee6affected
LinuxLinux4684997d9eea29380000e062755aa6d368d789a3 < 538c51e9d124cf656f2dd0c0394a8545efc7102daffected
LinuxLinux5.2affected
LinuxLinux0 < 5.2unaffected
LinuxLinux6.6.148 <= 6.6.*unaffected
LinuxLinux6.12.101 <= 6.12.*unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc5 <= *unaffected

Weaknesses

References