CVE-2026-68403
Received Received - Intake

Kernel Workqueue Use-After-Free in Broadcom WiFi SDIO Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls brcmf_sdio_remove(). brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the work item before the first failure path that can reach brcmf_sdio_remove(), so the cleanup path always observes a valid work object. This issue was found by our static analysis tool and then confirmed by manual review of the probe error path and the remove-time work drain. The problem pattern is an early setup failure that reaches a cleanup helper which cancels an embedded work item before its initializer has run. A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in the stack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68403
EUVD
EUVD-2026-55589

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
brcm brcmfmac *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper initialization of SDIO data work in the brcmfmac WiFi driver. The issue occurs when brcmf_sdio_probe() allocates bus memory but fails to initialize the workqueue before storing the bus pointer. If allocation fails, cleanup calls brcmf_sdio_remove(), which cancels the uninitialized work item, leading to a use-after-free or invalid work drain.

Detection Guidance

This vulnerability is specific to the Linux kernel's brcmfmac WiFi driver and involves improper initialization of SDIO data work. Detection requires checking the kernel version and driver state. Use commands like 'uname -a' to verify kernel version and 'lsmod | grep brcmfmac' to check if the driver is loaded. If the driver is loaded, inspect kernel logs for work queue errors with 'dmesg | grep brcmfmac'.

Impact Analysis

This could cause system instability or crashes if the WiFi driver fails during initialization. Attackers might exploit it to trigger kernel panics or denial-of-service conditions by forcing workqueue allocation failures.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If immediate updating is not possible, disable the brcmfmac driver by blacklisting it with 'echo blacklist brcmfmac >> /etc/modprobe.d/blacklist.conf' followed by 'update-initramfs -u' and rebooting. Monitor kernel updates for a permanent fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68403. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart