CVE-2026-68192

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. The brcmf_pcie_release_scratchbuffers() function fails to clear pointers after freeing Direct Memory Access (DMA) buffers. This oversight can lead to a 'double free' vulnerability, where the same memory region is released multiple times, particularly during device reset and removal. A local attacker could potentially exploit this flaw to cause memory corruption, resulting in a system crash and a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because successful exploitation requires specific hardware configurations and local privileges to trigger device reset or removal operations. In typical Red Hat Enterprise Linux enterprise deployments, Wi-Fi hardware is rarely present or actively utilized, significantly limiting exposure. On systems where Broadcom PCIe wireless devices are deployed, an attacker must induce consecutive reset and teardown events to trigger the double-free condition, primarily leading to a kernel crash and denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.