CVE-2026-68192: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68192 Overview

CVE-2026-68192 is a double-free vulnerability in the Linux kernel brcmfmac Broadcom Wi-Fi driver. The flaw resides in brcmf_pcie_release_scratchbuffers(), which frees the shared.scratch and shared.ringupd DMA buffers via dma_free_coherent() but never clears the pointers afterward. When the bus reset teardown path (brcmf_pcie_reset) runs before device removal, the subsequent brcmf_pcie_remove() call invokes dma_free_coherent() a second time on the already-freed allocation. An in-house static analysis tool identified the issue in the sibling function release_ringbuffers(), which correctly NULLs its pointers after release.

Critical Impact
A double-free on DMA-coherent memory can corrupt kernel heap metadata and enable local privilege escalation or kernel memory disclosure on systems using Broadcom PCIe Wi-Fi hardware.

Affected Products

Linux kernel brcmfmac PCIe driver (Broadcom FullMAC Wi-Fi)
Systems with Broadcom PCIe Wi-Fi adapters using the FullMAC firmware interface
Distributions shipping affected kernel versions prior to the upstream fixes

Discovery Timeline

2026-08-10 - CVE-2026-68192 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68192

Vulnerability Analysis

The vulnerability stems from missing idempotency in a resource-release function inside the brcmfmac PCIe host interface. The driver maintains two DMA-coherent buffers used to exchange scratch data and ring update state with device firmware. When brcmf_pcie_release_scratchbuffers() frees these allocations, it does not reset the corresponding struct members to NULL. Two independent teardown paths reference the same shared state, so the second path re-frees the buffers.

The issue is reachable across an adjacent network attack surface. An attacker capable of forcing a bus reset, followed by device removal, can trigger the redundant free. The double-free operates on dma_free_coherent(), corrupting DMA bookkeeping and slab allocator metadata. The upstream fix mirrors the pattern used by release_ringbuffers(), which NULLs commonrings, flowrings, and idxbuf after release, ensuring later calls observe that the allocation has already been returned.

Root Cause

The root cause is missing pointer invalidation after dma_free_coherent() in brcmf_pcie_release_scratchbuffers(). Because both brcmf_pcie_reset (the bus reset .reset callback) and brcmf_pcie_remove() call this function, the second invocation dereferences and frees the same DMA address twice.

Attack Vector

Exploitation requires adjacent network positioning combined with the ability to induce a bus reset on a target Broadcom PCIe Wi-Fi device, followed by device removal. Crafted firmware events or physical-layer conditions that force brcmf_pcie_reset before teardown can chain into the double-free. Successful corruption of the kernel slab allocator can be leveraged for privilege escalation. Refer to the upstream commits in git.kernel.org for the precise code diff.

Detection Methods for CVE-2026-68192

Indicators of Compromise

Kernel oops or panic messages referencing brcmf_pcie_release_scratchbuffers, dma_free_coherent, or slab corruption on hosts with Broadcom Wi-Fi adapters
Repeated brcmfmac bus reset events immediately followed by device removal in dmesg
Unexpected brcmfmac driver reloads or PCIe hotplug events under normal operating conditions

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK and CONFIG_SLUB_DEBUG on test systems to catch double-free conditions in the brcmfmac release path
Monitor kernel logs for WARNING traces originating from mm/slub.c or kernel/dma/ following Wi-Fi driver reset activity
Correlate PCIe reset counters with driver unbind operations in host telemetry

Monitoring Recommendations

Ingest kernel ring buffer messages into a centralized log platform and alert on brcmfmac warnings paired with slab corruption strings
Track kernel version inventory across endpoints to confirm patched builds are deployed on hardware using Broadcom Wi-Fi
Baseline Wi-Fi driver reset frequency and flag statistical anomalies that could indicate exploitation attempts

How to Mitigate CVE-2026-68192

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 044fca8f45ba, 0ca80328df23, 538c51e9d124, 5a045c2f0fbf, and b7d1d8cb1bdc
Update to a distribution kernel that incorporates the brcmfmac idempotent release fix
Restrict physical and adjacent-network access to devices with Broadcom PCIe Wi-Fi that cannot be immediately patched

Patch Information

The fix NULLs the shared.scratch and shared.ringupd pointers after dma_free_coherent() inside brcmf_pcie_release_scratchbuffers(), matching the pattern used by release_ringbuffers(). Consult the upstream commits: 044fca8f45ba, 0ca80328df23, 538c51e9d124, 5a045c2f0fbf, and b7d1d8cb1bdc.

Workarounds

Blacklist the brcmfmac module on systems that do not require Broadcom Wi-Fi functionality until a patched kernel is available
Disable PCIe hotplug and bus reset triggers where operationally acceptable to reduce the reachability of the redundant teardown path
Isolate affected hosts from untrusted adjacent Wi-Fi networks that could provide the attacker foothold required for exploitation

bash

# Temporarily blacklist the brcmfmac driver until patched kernel is deployed
echo "blacklist brcmfmac" | sudo tee /etc/modprobe.d/blacklist-brcmfmac.conf
sudo update-initramfs -u
sudo reboot