CVE-2026-68403: Linux Kernel Race Condition Vulnerability

CVE-2026-68403 Overview

CVE-2026-68403 is a Linux kernel vulnerability in the Broadcom FullMAC WLAN driver (brcmfmac) affecting the Secure Digital Input Output (SDIO) probe path. The brcmf_sdio_probe() function stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. When the workqueue allocation fails, the error path calls brcmf_sdio_remove(), which unconditionally cancels bus->datawork before its work item has been initialized. This produces an invalid work drain on an uninitialized object, detectable via DEBUG_OBJECTS. The flaw was identified by static analysis and reproduced with a QEMU proof of concept that forced alloc_ordered_workqueue() to fail.

Critical Impact
Cancellation of an uninitialized work item during driver probe failure can trigger kernel warnings, memory corruption, or a denial-of-service condition on systems using Broadcom SDIO Wi-Fi hardware.

Affected Products

Linux kernel — brcmfmac wireless driver (SDIO transport)
Systems using Broadcom FullMAC SDIO Wi-Fi chipsets
Kernel branches referenced by upstream stable commits 2a665946, 5c342437, 6bd21ec8, c73c3fc1, and f50a2b9e

Discovery Timeline

2026-08-10 - CVE-2026-68403 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68403

Vulnerability Analysis

The defect resides in brcmf_sdio_probe() in the brcmfmac driver. The probe function assigns the newly allocated bus structure to sdiodev->bus before it calls alloc_ordered_workqueue() and initializes the embedded datawork item with INIT_WORK(). If the workqueue allocation fails, control jumps to the fail label and invokes brcmf_sdio_remove().

The remove helper unconditionally calls the work cancellation routine on bus->datawork. Because the work item has never been initialized, the kernel operates on an invalid object. When CONFIG_DEBUG_OBJECTS is enabled, the kernel emits a warning identifying brcmf_sdio_probe() and brcmf_sdio_remove() in the call stack. In hardened configurations the invalid drain can corrupt list state maintained by the workqueue subsystem.

This is a classic early-setup ordering defect: a cleanup helper that expects a fully constructed object executes against a partially constructed one. The upstream fix reorders initialization so that INIT_WORK(&bus->datawork) runs before any failure path that can reach brcmf_sdio_remove().

Root Cause

The root cause is incorrect initialization ordering. The driver publishes the bus pointer into sdiodev->bus and takes error paths that invoke shared cleanup logic before the embedded work item has been initialized. The cleanup path assumes a valid work object and does not gate the cancel call on an initialization flag.

Attack Vector

Exploitation requires triggering an allocation failure inside brcmf_sdio_probe() at the specific window between bus assignment and work initialization. The published proof of concept uses QEMU to force alloc_ordered_workqueue() to return failure. Realistic triggers include memory pressure, fault injection, or malicious SDIO device presentation on systems that expose SDIO hot-attach. The vulnerability is local and dependent on the presence of vulnerable hardware or virtualized SDIO transports.

No public exploit code targeting production systems has been published. See the upstream commits linked below for technical details.

Detection Methods for CVE-2026-68403

Indicators of Compromise

Kernel log entries containing ODEBUG or DEBUG_OBJECTS warnings that reference brcmf_sdio_probe and brcmf_sdio_remove in the backtrace.
Repeated brcmfmac probe failures accompanied by workqueue-related kernel warnings on systems with Broadcom SDIO Wi-Fi hardware.
Kernel panics or list-corruption oops messages originating from the workqueue cancellation code path during driver initialization.

Detection Strategies

Inventory kernel versions across Linux endpoints and compare against the stable trees patched by the upstream commits referenced in this advisory.
Collect dmesg and journald output from systems using brcmfmac and search for probe-time failures near workqueue allocation.
Enable CONFIG_DEBUG_OBJECTS_WORK on test images to surface invalid work object usage during driver regression testing.

Monitoring Recommendations

Forward kernel logs from Linux endpoints to a centralized logging pipeline and alert on brcmfmac probe failures.
Track kernel package versions as part of standard vulnerability management and flag hosts running unpatched branches.
Monitor virtualized environments that emulate SDIO devices for repeated driver load failures that could indicate fault-injection activity.

How to Mitigate CVE-2026-68403

Immediate Actions Required

Apply the upstream brcmfmac fix by updating to a Linux kernel that includes the patches referenced in the stable commits below.
Rebuild and redeploy custom kernels that carry the brcmfmac driver to include the corrected initialization order.
On systems that do not use Broadcom SDIO Wi-Fi, blacklist the brcmfmac module to eliminate exposure until patched kernels are deployed.

Patch Information

The fix moves INIT_WORK(&bus->datawork, brcmf_sdio_dataworker) ahead of the first failure path that can call brcmf_sdio_remove(), ensuring the cleanup helper always observes a valid work object. Corrected code is available in the following upstream commits: Kernel.org Commit 2a665946, Kernel.org Commit 5c342437, Kernel.org Commit 6bd21ec8, Kernel.org Commit c73c3fc1, and Kernel.org Commit f50a2b9e.

Workarounds

Unload and prevent auto-loading of the brcmfmac module on affected hosts that do not require Broadcom SDIO Wi-Fi.
Disable SDIO Wi-Fi hardware in firmware or via device tree overlays on embedded platforms where practical.
Avoid attaching untrusted SDIO devices to virtualized guests running unpatched kernels.

bash

# Blacklist brcmfmac until patched kernel is deployed
echo 'blacklist brcmfmac' | sudo tee /etc/modprobe.d/blacklist-brcmfmac.conf
sudo rmmod brcmfmac 2>/dev/null || true
sudo update-initramfs -u