CVE-2026-68192: Linux Vulnerability (CVSS 8.8)

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers idempotent brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterwards, unlike the sibling release_ringbuffers() which NULLs commonrings/flowrings/idxbuf on release. Both the bus_reset .reset callback (brcmf_pcie_reset) and brcmf_pcie_remove() call release_scratchbuffers. When reset teardown has run before removal, remove's own teardown would call dma_free_coherent() a second time on the already-freed DMA allocation. NULL the pointers after free, matching release_ringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch. This issue was found by an in-house static analysis tool.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.40%

33.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 4684997d9eea29380000e062755aa6d368d789a3, < 81c58a206d1deee01f4c29236d4154c0872f2a38; >= 4684997d9eea29380000e062755aa6d368d789a3, < 382ee00b2d1e31869ae576a60d3fbe7a2153512f; >= 4684997d9eea29380000e062755aa6d368d789a3, < 739b686aecdb14a6065300ea53401f043e51fd22; >= 4684997d9eea29380000e062755aa6d368d789a3, < b7d1d8cb1bdca56aecebacd2896615da0acc126a; >= 4684997d9eea29380000e062755aa6d368d789a3, < 5a045c2f0fbf029873d2295178fa0785ade35af0; >= 4684997d9eea29380000e062755aa6d368d789a3, < 044fca8f45ba9ab6ca526163155234cf88287ff5; >= 4684997d9eea29380000e062755aa6d368d789a3, < 0ca80328df23f851c86866720d4977783c919ee6; >= 4684997d9eea29380000e062755aa6d368d789a3, < 538c51e9d124cf656f2dd0c0394a8545efc7102d
Linux	Linux	5.2

References

Timeline

Published: Aug 10, 2026
Last Modified: Aug 19, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-68192?

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make release_scratchbuffers idempotent brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterwards, unlike the sibling release_ringbuffers() which NULLs commonrings/flowrings/idxbuf on release. Both the bus_reset .reset callback (brcmf_pcie_reset) and brcmf_pcie_remove() call release_scratchbuffers. When reset teardown has run before removal, remove's own teardown would call dma_free_coherent() a second time on the already-freed DMA allocation. NULL the pointers after free, matching release_ringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch. This issue was found by an in-house static analysis tool.

How severe is CVE-2026-68192?

CVE-2026-68192 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.

How do I fix CVE-2026-68192?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →