CVE-2026-68304

What it actually does

Improper configuration of firmware supplicant mode in brcmfmac driver leads to a kernel warning when brcmf_cfg80211_set_pmk is called for 802.1X-SHA256 authentication because use_fwsup is not set with BRCMF_PROFILE_FWSUP_1X based on wpa_auth mode.

Why it matters to the business

May produce kernel warnings and potential instability on Linux systems using Broadcom wireless hardware with enterprise 802.1X or WPA3 authentication, affecting wireless reliability in affected deployments.

How an attack unfolds

An attacker triggers the condition by initiating 802.1X-SHA256 authentication that reaches brcmf_cfg80211_set_pmk without the required firmware supplicant flag, producing the call trace; no remote code execution path is indicated.

How to fix it

Apply the upstream kernel fix that sets use_fwsup with BRCMF_PROFILE_FWSUP_1X when wpa_auth indicates 1x_256 mode; update to the first patched kernel version containing this change.

How to confirm the fix worked

Confirm absence of the brcmf_cfg80211_set_pmk warning in dmesg or kernel logs during 802.1X-SHA256 PMK operations on brcmfmac devices after patching.

Typical attack path

1. Establish 802.1X-SHA256 connection context with wpa_auth set to 1x_256 mode
2. Invoke nl80211_set_pmk leading to brcmf_cfg80211_set_pmk without BRCMF_PROFILE_FWSUP_1X
3. Trigger kernel WARN_ON in cfg80211.c

How to detect it

Search kernel logs and dmesg for the exact warning string containing brcmf_cfg80211_set_pmk and CPU/PID details around the time of 802.1X authentication events.

What your security team should do

• Prioritize kernel updates for systems with Broadcom wireless adapters using enterprise authentication
• Add kernel log monitoring rules for brcmfmac warning strings
• Test wireless 802.1X functionality post-update to verify stability