« Volver al listado

CVE-2026-68403

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: initialize SDIO data work before cleanup

brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls brcmf_sdio_remove().

brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the work item before the first failure path that can reach brcmf_sdio_remove(), so the cleanup path always observes a valid work object.

This issue was found by our static analysis tool and then confirmed by manual review of the probe error path and the remove-time work drain.

Leer descripción completaMostrar menos

The problem pattern is an early setup failure that reaches a cleanup helper which cancels an embedded work item before its initializer has run.

A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in the stack.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68403",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "860887d22890417d43ef8298f0cc4865e29b54de",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "9a4be91e5bb032b34cb3c962f6d4f82e7ef09364",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "fb12c87ae855346321af72e57a93c146205f1090",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "f50a2b9e57a751e70ae9a272875d80d39eaccd6a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "6bd21ec8549a5854dd64204a66289952917a924c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "5c342437ea44bb829680ca9e4f683dd5b325b219",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "c73c3fc1c7ca5a927639f0884624cb244ba791e4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9982464379e81ece51ced03ebecbbcd34ea367a6",
              "lessThan": "2a665946e0407a05a3f81bd56a08553c446498e0",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:33.830",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2a665946e0407a05a3f81bd56a08553c446498e0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5c342437ea44bb829680ca9e4f683dd5b325b219",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6bd21ec8549a5854dd64204a66289952917a924c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/860887d22890417d43ef8298f0cc4865e29b54de",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9a4be91e5bb032b34cb3c962f6d4f82e7ef09364",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c73c3fc1c7ca5a927639f0884624cb244ba791e4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f50a2b9e57a751e70ae9a272875d80d39eaccd6a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fb12c87ae855346321af72e57a93c146205f1090",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: initialize SDIO data work before cleanup\n\nbrcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before\nallocating the ordered workqueue. If that allocation fails, the function\njumps to fail and calls brcmf_sdio_remove().\n\nbrcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the\nwork item before the first failure path that can reach brcmf_sdio_remove(),\nso the cleanup path always observes a valid work object.\n\nThis issue was found by our static analysis tool and then confirmed by\nmanual review of the probe error path and the remove-time work drain. The\nproblem pattern is an early setup failure that reaches a cleanup helper\nwhich cancels an embedded work item before its initializer has run.\n\nA QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in\nbrcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The\nresulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports\nthe invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in\nthe stack."
    }
  ],
  "lastModified": "2026-08-19T17:20:48.187",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}