{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-68192",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-68192"
  ],
  "published": "2026-08-10T12:08:00Z",
  "summary": "wifi: brcmfmac: make release_scratchbuffers idempotent",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: make release_scratchbuffers idempotent\n\nbrcmf_pcie_release_scratchbuffers() frees the shared.scratch and\nshared.ringupd DMA buffers with dma_free_coherent() but does not clear\nthe pointers afterwards, unlike the sibling release_ringbuffers() which\nNULLs commonrings/flowrings/idxbuf on release.\n\nBoth the bus_reset .reset callback (brcmf_pcie_reset) and\nbrcmf_pcie_remove() call release_scratchbuffers.  When reset teardown\nhas run before removal, remove's own teardown would call\ndma_free_coherent() a second time on the already-freed DMA allocation.\n\nNULL the pointers after free, matching release_ringbuffers(), so a later\nrelease observes that the allocation has already been released.  This\npatch makes repeated sequential release safe; the reset-work lifetime is\nhandled separately by the following patch.\n\nThis issue was found by an in-house static analysis tool.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.183",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68192"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/81c58a206d1deee01f4c29236d4154c0872f2a38"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/382ee00b2d1e31869ae576a60d3fbe7a2153512f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/739b686aecdb14a6065300ea53401f043e51fd22"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b7d1d8cb1bdca56aecebacd2896615da0acc126a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5a045c2f0fbf029873d2295178fa0785ade35af0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/044fca8f45ba9ab6ca526163155234cf88287ff5"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0ca80328df23f851c86866720d4977783c919ee6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/538c51e9d124cf656f2dd0c0394a8545efc7102d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-19T16:47:12Z"
  }
}