CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68403

The CVE concerns the Linux kernel driver brcmfmac SDIO path. In brcmf_sdio_probe(), the newly allocated bus is stored in sdiodev->bus before the ordered workqueue is initialized. If allocation fails, the path can reach brcmf_sdio_remove(), which unconditionally cancels bus->datawork. The bu...

CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68304

This CVE (CVE-2026-68304) affects the Linux kernel’s wireless driver brcmfmac (Broadcom brcm80211) and relates to a call trace warning triggered by 802.1X-SHA256 during PMK handling. The fix involves configuring wpa_supplicant/brcmfmac usage to enable 1X authentication support by setting "use_fws...

CVE-2026-68304 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up "usefwsup" with BRCMFPROFILEFWSUP1X. Or it will happen trace warning when call brcmfcfg80211setpmk. 4481.831101 ------------ cut...

CVE-2026-68304 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up "usefwsup" with BRCMFPROFILEFWSUP1X. Or it will happen trace warning when call brcmfcfg80211setpmk. 4481.831101 ------------ cut...

EUVD-2026-55405

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up "usefwsup" with BRCMFPROFILEFWSUP1X. Or it will happen trace warning when call brcmfcfg80211setpmk. 4481.831101 ------------ cut...

EUVD-2026-55293

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...

CVE-2026-68192

CVE-2026-68192 — normal mode Affect: Linux kernel with the brcmfmac WLAN driver. The function brcmf_pcie_release_scratchbuffers frees DMA buffers (shared.scratch and shared.ringupd) via dma_free_coherent() but does not clear the pointers, unlike release_ringbuffers(), which NULLs related pointers...

CVE-2026-68192 wifi: brcmfmac: make release_scratchbuffers idempotent

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmmac – Fix for crashes occurring when sending Action Frames in standalone AP Mode Currently, whenever an Action Frame needs to be transmitted, the brcmmac driver always uses the P2P vif to send the “actframe” IOVAR to th...

Linux Distros Unpatched Vulnerability : CVE-2026-68403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. I...

Linux Distros Unpatched Vulnerability : CVE-2026-68192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoheren...

The vulnerability in the `drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c` file of the Broadcom wireless adapter driver for the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c file of the Broadcom wireless adapter driver for the Linux operating system is related to an improper check of a specified index, position, or offset in the input data. Exploiting this vulnerability could allow an...

Linux Distros Unpatched Vulnerability : CVE-2026-68304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up usefwsup with BRCMFPROFILEFWSUP1X. Or it will happen trace...

SUSE CVE-2026-64586

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs "reset" entry both schedule drvr-busreset, whose callback recovers drvr through containerof and dereferences it. The removal path frees drvr...

CVE-2026-64586

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs "reset" entry both schedule drvr-busreset, whose callback recovers drvr through containerof and dereferences it. The removal path frees drvr...

UBUNTU-CVE-2026-64586

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs "reset" entry both schedule drvr-busreset, whose callback recovers drvr through containerof and dereferences it. The removal path frees drvr...

CVE-2026-64586

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain busreset work on device removal brcmffwcrashed and the debugfs "reset" entry both schedule drvr-busreset, whose callback recovers drvr through containerof and dereferences it. The removal path frees drvr...

CVE-2026-64586

CVE-2026-64586 Linux kernel vulnerability in brcmfmac: removal of devices could race with outstanding bus_reset work. The fix adds a per-bus mutex (bus_reset_lock) and routes arming of the bus_reset through brcmf_bus_schedule_reset(), cancels via brcmf_bus_cancel_reset_work(), and drains the runn...