CVE-2026-68192

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: brcmfmac: make release_scratchbuffers idempotent<br /> <br /> brcmf_pcie_release_scratchbuffers() frees the shared.scratch and<br /> shared.ringupd DMA buffers with dma_free_coherent() but does not clear<br /> the pointers afterwards, unlike the sibling release_ringbuffers() which<br /> NULLs commonrings/flowrings/idxbuf on release.<br /> <br /> Both the bus_reset .reset callback (brcmf_pcie_reset) and<br /> brcmf_pcie_remove() call release_scratchbuffers. When reset teardown<br /> has run before removal, remove&amp;#39;s own teardown would call<br /> dma_free_coherent() a second time on the already-freed DMA allocation.<br /> <br /> NULL the pointers after free, matching release_ringbuffers(), so a later<br /> release observes that the allocation has already been released. This<br /> patch makes repeated sequential release safe; the reset-work lifetime is<br /> handled separately by the following patch.<br /> <br /> This issue was found by an in-house static analysis tool.