CVE-2026-68192 wifi: brcmfmac: make release_scratchbuffers idempotent
A double-free vulnerability in the brcmfmac Wi-Fi driver allows attackers to cause denial of service or potentially execute code via repeated teardown operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68192?
CVE-2026-68192 is a high-severity use after free vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: make release_scratchbuffers idempotent
brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterwards, unlike the sibling release_ringbuffers() which NULLs commonrings/flowrings/idxbuf on release.
Both the bus_reset .reset callback (brcmf_pcie_reset) and brcmf_pcie_remove() call release_scratchbuffers. When reset teardown has run before removal, remove's own teardown would call dma_free_coherent() a second time on the already-freed DMA allocation.
NULL the pointers after free, matching release_ringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch.
This issue was found by an in-house static analysis tool.
Weakness: CWE-415
Which versions are affected by CVE-2026-68192?
How do I fix CVE-2026-68192?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-68192 being exploited?
There is no known exploitation of CVE-2026-68192 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68192, DEBIAN-CVE-2026-68192, GHSA-52hv-vfrj-x3fv, UBUNTU-CVE-2026-68192.