---
id: CVE-2026-68192
title: 'wifi: brcmfmac: make release_scratchbuffers idempotent'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: brcmfmac: make release_scratchbuffers idempotent

  brcmf_pcie_release_scratchbuffers() frees the shared.scratch and
  shared.ringupd DMA buffers with dma_free_cohere…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    81c58a206d1deee01f4c29236d4154c0872f2a38
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    382ee00b2d1e31869ae576a60d3fbe7a2153512f
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    739b686aecdb14a6065300ea53401f043e51fd22
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    b7d1d8cb1bdca56aecebacd2896615da0acc126a
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    5a045c2f0fbf029873d2295178fa0785ade35af0
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    044fca8f45ba9ab6ca526163155234cf88287ff5
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    0ca80328df23f851c86866720d4977783c919ee6
  - >-
    Linux >= 4684997d9eea29380000e062755aa6d368d789a3 <
    538c51e9d124cf656f2dd0c0394a8545efc7102d
  - Linux 5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:45:36.717403Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:02.803Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68192'
references:
  - url: 'https://git.kernel.org/stable/c/81c58a206d1deee01f4c29236d4154c0872f2a38'
  - url: 'https://git.kernel.org/stable/c/382ee00b2d1e31869ae576a60d3fbe7a2153512f'
  - url: 'https://git.kernel.org/stable/c/739b686aecdb14a6065300ea53401f043e51fd22'
  - url: 'https://git.kernel.org/stable/c/b7d1d8cb1bdca56aecebacd2896615da0acc126a'
  - url: 'https://git.kernel.org/stable/c/5a045c2f0fbf029873d2295178fa0785ade35af0'
  - url: 'https://git.kernel.org/stable/c/044fca8f45ba9ab6ca526163155234cf88287ff5'
  - url: 'https://git.kernel.org/stable/c/0ca80328df23f851c86866720d4977783c919ee6'
  - url: 'https://git.kernel.org/stable/c/538c51e9d124cf656f2dd0c0394a8545efc7102d'
tags:
  - cve.org
epss: 0.00407
epssPercentile: 0.3342
ingestedAt: '2026-10-16T17:24:46.848Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: make release_scratchbuffers idempotent

brcmf_pcie_release_scratchbuffers() frees the shared.scratch and
shared.ringupd DMA buffers with dma_free_coherent() but does not clear
the pointers afterwards, unlike the sibling release_ringbuffers() which
NULLs commonrings/flowrings/idxbuf on release.

Both the bus_reset .reset callback (brcmf_pcie_reset) and
brcmf_pcie_remove() call release_scratchbuffers.  When reset teardown
has run before removal, remove's own teardown would call
dma_free_coherent() a second time on the already-freed DMA allocation.

NULL the pointers after free, matching release_ringbuffers(), so a later
release observes that the allocation has already been released.  This
patch makes repeated sequential release safe; the reset-work lifetime is
handled separately by the following patch.

This issue was found by an in-house static analysis tool.

## Affected

- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 81c58a206d1deee01f4c29236d4154c0872f2a38`
- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 382ee00b2d1e31869ae576a60d3fbe7a2153512f`
- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 739b686aecdb14a6065300ea53401f043e51fd22`
- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < b7d1d8cb1bdca56aecebacd2896615da0acc126a`
- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 5a045c2f0fbf029873d2295178fa0785ade35af0`
- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 044fca8f45ba9ab6ca526163155234cf88287ff5`
- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 0ca80328df23f851c86866720d4977783c919ee6`
- `Linux >= 4684997d9eea29380000e062755aa6d368d789a3 < 538c51e9d124cf656f2dd0c0394a8545efc7102d`
- `Linux 5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.