GHSA-52HV-VFRJ-X3FV

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-19 18:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: make release_scratchbuffers idempotent

brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterwards, unlike the sibling release_ringbuffers() which NULLs commonrings/flowrings/idxbuf on release.

Both the bus_reset .reset callback (brcmf_pcie_reset) and brcmf_pcie_remove() call release_scratchbuffers. When reset teardown has run before removal, remove's own teardown would call dma_free_coherent() a second time on the already-freed DMA allocation.

NULL the pointers after free, matching release_ringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch.

This issue was found by an in-house static analysis tool.

Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68192"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T13:20:06Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: make release_scratchbuffers idempotent\n\nbrcmf_pcie_release_scratchbuffers() frees the shared.scratch and\nshared.ringupd DMA buffers with dma_free_coherent() but does not clear\nthe pointers afterwards, unlike the sibling release_ringbuffers() which\nNULLs commonrings/flowrings/idxbuf on release.\n\nBoth the bus_reset .reset callback (brcmf_pcie_reset) and\nbrcmf_pcie_remove() call release_scratchbuffers.  When reset teardown\nhas run before removal, remove\u0027s own teardown would call\ndma_free_coherent() a second time on the already-freed DMA allocation.\n\nNULL the pointers after free, matching release_ringbuffers(), so a later\nrelease observes that the allocation has already been released.  This\npatch makes repeated sequential release safe; the reset-work lifetime is\nhandled separately by the following patch.\n\nThis issue was found by an in-house static analysis tool.",
  "id": "GHSA-52hv-vfrj-x3fv",
  "modified": "2026-08-19T18:32:10Z",
  "published": "2026-08-10T15:33:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68192"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/044fca8f45ba9ab6ca526163155234cf88287ff5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0ca80328df23f851c86866720d4977783c919ee6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/382ee00b2d1e31869ae576a60d3fbe7a2153512f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/538c51e9d124cf656f2dd0c0394a8545efc7102d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a045c2f0fbf029873d2295178fa0785ade35af0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/739b686aecdb14a6065300ea53401f043e51fd22"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/81c58a206d1deee01f4c29236d4154c0872f2a38"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b7d1d8cb1bdca56aecebacd2896615da0acc126a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.