CVE-2026-68304: Linux Kernel brcmfmac Vulnerability

CVE-2026-68304 Overview

CVE-2026-68304 is a Linux kernel vulnerability in the brcmfmac Broadcom FullMAC Wi-Fi driver. The driver fails to configure the firmware supplicant mode correctly when wpa_auth operates in 1x_256 (802.1X-SHA256) mode. Specifically, the driver does not set use_fwsup to BRCMF_PROFILE_FWSUP_1X, which triggers a WARN inside brcmf_cfg80211_set_pmk() when user space installs a Pairwise Master Key (PMK) via nl80211_set_pmk. The result is a kernel call trace and functional degradation of 802.1X-SHA256 authentication on affected Broadcom Wi-Fi chipsets.

Critical Impact
The flaw generates a kernel warning during PMK installation on 802.1X-SHA256 wireless connections, disrupting enterprise Wi-Fi authentication on systems using the brcmfmac driver.

Affected Products

Linux kernel brcmfmac wireless driver (drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c)
Broadcom FullMAC Wi-Fi chipsets managed by brcmfmac
Linux distributions shipping vulnerable stable kernel versions prior to the referenced fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68304 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68304

Vulnerability Analysis

The brcmfmac driver manages Wi-Fi association state through a per-interface profile structure. When user space configures WPA/WPA2-Enterprise authentication, the driver inspects wpa_auth to decide whether firmware-offloaded supplicant handling (use_fwsup) is required. The code path handling 1x_256 (802.1X with HMAC-SHA256 key derivation) omits the assignment of BRCMF_PROFILE_FWSUP_1X to use_fwsup.

When the supplicant subsequently calls nl80211_set_pmk to push the PMK into the driver, control reaches brcmf_cfg80211_set_pmk() at cfg80211.c:7242. The function validates that the profile is in a firmware-supplicant 802.1X mode. Because the flag was never set, a WARN_ON fires, producing the observed call trace passing through genl_rcv_msg, netlink_rcv_skb, and __sys_sendmsg. On kernels configured with panic_on_warn, this converts to a kernel panic and denial of service.

Root Cause

The root cause is missing state initialization in the 802.1X-SHA256 branch of the brcmfmac connect path. The driver treats 1x_256 as distinct from standard 1x and fails to propagate the firmware-supplicant flag, producing an inconsistent internal state that later triggers a defensive WARN in the PMK handler.

Attack Vector

Exploitation requires a local user with CAP_NET_ADMIN (or an authorized wpa_supplicant process) to trigger a WPA2/WPA3-Enterprise association using 802.1X-SHA256. No remote or unauthenticated network attack path is documented. The primary impact is availability: repeated warnings, log pollution, and potential panic on hardened kernels.

No public proof-of-concept exists and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.2%, indicating low near-term exploitation likelihood. No synthetic exploitation code is presented here; see the referenced stable-tree commits for the fix context.

Detection Methods for CVE-2026-68304

Indicators of Compromise

Kernel log entries containing WARNING: CPU: ... at drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:7242 brcmf_cfg80211_set_pmk
Call traces referencing nl80211_set_pmk+0x183/0x250 [cfg80211] originating from a wpa_supplicant process
Failed or unstable 802.1X-SHA256 (WPA-EAP-SHA256) enterprise Wi-Fi associations on Broadcom FullMAC hardware

Detection Strategies

Monitor dmesg and /var/log/kern.log for brcmf_cfg80211_set_pmk warnings correlated with EAP authentication attempts.
Query endpoint telemetry for kernel version and loaded module brcmfmac to identify unpatched hosts.
Alert on WARN-class kernel events emitted via netconsole or systemd journal fields SYSLOG_IDENTIFIER=kernel and PRIORITY<=4.

Monitoring Recommendations

Track EAP-TLS/PEAP handshake success rates on fleets using Broadcom Wi-Fi to detect regressions after enabling 802.1X-SHA256.
Forward kernel logs to a central SIEM and create a rule for the exact warning signature at cfg80211.c:7242.
Inventory kernel package versions across Linux endpoints and compare against distribution advisories referencing the fix commits.

How to Mitigate CVE-2026-68304

Immediate Actions Required

Apply the stable-tree kernel update containing the brcmfmac fix and reboot affected systems.
Identify endpoints running the brcmfmac module with lsmod | grep brcmfmac and prioritize patching for hosts using 802.1X-SHA256 enterprise Wi-Fi.
Disable panic_on_warn on production hosts until patched to prevent the warning from escalating into a kernel panic.

Patch Information

The upstream fix ensures use_fwsup is set to BRCMF_PROFILE_FWSUP_1X when wpa_auth is 1x_256. The change is available in the Linux stable tree via commits 00ebbf0, 137e471, 7cb34f6, bd4fac0, and d3ac5b3. Consume the fix from the appropriate distribution kernel package.

Workarounds

Configure affected endpoints to use standard WPA-EAP (SHA-1 KDF) rather than WPA-EAP-SHA256 until the patched kernel is deployed.
On systems where Wi-Fi is not required, unload the driver with modprobe -r brcmfmac and blacklist it via /etc/modprobe.d/.
Route enterprise authentication over wired Ethernet on affected devices as a temporary control.

bash

# Verify brcmfmac module presence and kernel version
uname -r
lsmod | grep brcmfmac
modinfo brcmfmac | grep -E 'filename|version'

# Temporarily disable the driver until patched
sudo modprobe -r brcmfmac
echo 'blacklist brcmfmac' | sudo tee /etc/modprobe.d/blacklist-brcmfmac.conf