CVE-2026-68192

What it actually does

Double-free of DMA-coherent scratch and ring-update buffers in brcmf_pcie_release_scratchbuffers because the pointers are not cleared after dma_free_coherent, allowing a subsequent call from brcmf_pcie_remove after brcmf_pcie_reset has already freed them.

Why it matters to the business

Kernel memory corruption or crash on systems using Broadcom PCIe Wi-Fi chips when the driver reset path runs before device removal, leading to unplanned reboots and loss of wireless connectivity.

How an attack unfolds

An attacker with local access or the ability to trigger driver reset (via bus error, power management, or module unload) forces the reset callback to free the buffers, then triggers device removal so the second free path executes on the already-released memory.

How to fix it

Apply the upstream patch that NULLs shared.scratch and shared.ringupd after dma_free_coherent; rebuild and deploy the fixed kernel. No backported fixed versions are listed.

How to confirm the fix worked

Inspect brcmf_pcie.c for the added pointer-clearing statements after each dma_free_coherent in release_scratchbuffers; boot-test repeated reset/remove cycles on affected hardware.

Typical attack path

1. Obtain local execution or trigger conditions that cause brcmf_pcie_reset to run
2. Ensure brcmf_pcie_remove is subsequently invoked while the device is still registered
3. Trigger the second dma_free_coherent on the dangling pointers
4. Cause kernel panic or exploitable heap state from the double-free

How to detect it

Search kernel logs for repeated brcmf_pcie_release_scratchbuffers entries or DMA free warnings around device removal; correlate with PCIe bus reset events on Broadcom Wi-Fi hardware.

What your security team should do

• Prioritize kernel update on all systems exposing Broadcom brcmfmac PCIe wireless
• Monitor for double-free crashes in the brcmfmac driver
• Disable the driver or hardware if the update cannot be applied promptly