CVE-2026-68192

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the brcmfmac WiFi driver where the brcmf pcie release scratchbuffers() function frees shared.scratch and shared.ringupd DMA buffers using dma free coherent() but fails to clear the pointers. Because both the brcmf pcie reset callback and brcmf pcie remove() function call release scratchbuffers, a scenario where reset teardown occurs before removal leads to dma free coherent() being called a second time on already-freed DMA allocations. This creates a double-free condition. DMA (Direct Memory Access) is a feature that allows hardware to access main system memory independently of the central processing unit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.