{"id":"CVE-2026-68192","title":"wifi: brcmfmac: make release_scratchbuffers idempotent","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: make release_scratchbuffers idempotent\n\nbrcmf_pcie_release_scratchbuffers() frees the shared.scratch and\nshared.ringupd DMA buffers with dma_free_cohere…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 81c58a206d1deee01f4c29236d4154c0872f2a38","Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 382ee00b2d1e31869ae576a60d3fbe7a2153512f","Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 739b686aecdb14a6065300ea53401f043e51fd22","Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < b7d1d8cb1bdca56aecebacd2896615da0acc126a","Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 5a045c2f0fbf029873d2295178fa0785ade35af0","Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 044fca8f45ba9ab6ca526163155234cf88287ff5","Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 0ca80328df23f851c86866720d4977783c919ee6","Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 538c51e9d124cf656f2dd0c0394a8545efc7102d","Linux 5.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:45:36.717403Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:02.803Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68192","references":[{"url":"https://git.kernel.org/stable/c/81c58a206d1deee01f4c29236d4154c0872f2a38"},{"url":"https://git.kernel.org/stable/c/382ee00b2d1e31869ae576a60d3fbe7a2153512f"},{"url":"https://git.kernel.org/stable/c/739b686aecdb14a6065300ea53401f043e51fd22"},{"url":"https://git.kernel.org/stable/c/b7d1d8cb1bdca56aecebacd2896615da0acc126a"},{"url":"https://git.kernel.org/stable/c/5a045c2f0fbf029873d2295178fa0785ade35af0"},{"url":"https://git.kernel.org/stable/c/044fca8f45ba9ab6ca526163155234cf88287ff5"},{"url":"https://git.kernel.org/stable/c/0ca80328df23f851c86866720d4977783c919ee6"},{"url":"https://git.kernel.org/stable/c/538c51e9d124cf656f2dd0c0394a8545efc7102d"}],"tags":["cve.org"],"epss":0.00407,"epssPercentile":0.3342,"ingestedAt":"2026-10-16T17:24:46.848Z","slug":"CVE-2026-68192","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: make release_scratchbuffers idempotent\n\nbrcmf_pcie_release_scratchbuffers() frees the shared.scratch and\nshared.ringupd DMA buffers with dma_free_coherent() but does not clear\nthe pointers afterwards, unlike the sibling release_ringbuffers() which\nNULLs commonrings/flowrings/idxbuf on release.\n\nBoth the bus_reset .reset callback (brcmf_pcie_reset) and\nbrcmf_pcie_remove() call release_scratchbuffers.  When reset teardown\nhas run before removal, remove's own teardown would call\ndma_free_coherent() a second time on the already-freed DMA allocation.\n\nNULL the pointers after free, matching release_ringbuffers(), so a later\nrelease observes that the allocation has already been released.  This\npatch makes repeated sequential release safe; the reset-work lifetime is\nhandled separately by the following patch.\n\nThis issue was found by an in-house static analysis tool.\n\n## Affected\n\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 81c58a206d1deee01f4c29236d4154c0872f2a38`\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 382ee00b2d1e31869ae576a60d3fbe7a2153512f`\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 739b686aecdb14a6065300ea53401f043e51fd22`\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < b7d1d8cb1bdca56aecebacd2896615da0acc126a`\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 5a045c2f0fbf029873d2295178fa0785ade35af0`\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 044fca8f45ba9ab6ca526163155234cf88287ff5`\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 0ca80328df23f851c86866720d4977783c919ee6`\n- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 538c51e9d124cf656f2dd0c0394a8545efc7102d`\n- `Linux 5.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}