What is the CVSS score of CVE-2026-68192?

CVE-2026-68192 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68192?

CVE-2026-68192 affects Linux systems with Broadcom WiFi PCIe drivers in kernel 5.2 and later, creating a kernel memory corruption vulnerability that could enable system compromise.. A patch is available.

How to fix or mitigate CVE-2026-68192?

Within 24 hours, conduct an inventory of all Linux systems running kernel 5.2 or later with the brcmfmac driver loaded to identify scope of exposure. Within 7 days, coordinate with infrastructure teams to evaluate the vendor-released patch and establish testing and deployment timelines, prioritizing critical systems. Within 30 days, deploy the patch to all affected production systems and confirm stable operation.

Linux Kernel CVE-2026-68192

EUVD-2026-55293 HIGH

2026-08-10 Linux

GHSA-52hv-vfrj-x3fv

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC raised to High over NVD rating because the double-free requires a specific sequential reset-then-removal event chain, not a single-step trigger.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:03 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

8.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 12:00 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: make release_scratchbuffers idempotent

brcmf_pcie_release_scratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dma_free_coherent() but does not clear the pointers afterwards, unlike the sibling release_ringbuffers() which NULLs commonrings/flowrings/idxbuf on release.

Both the bus_reset .reset callback (brcmf_pcie_reset) and brcmf_pcie_remove() call release_scratchbuffers. When reset teardown has run before removal, remove's own teardown would call dma_free_coherent() a second time on the already-freed DMA allocation.

NULL the pointers after free, matching release_ringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch.

This issue was found by an in-house static analysis tool.

AnalysisAI

Double-free memory corruption in the Linux kernel's brcmfmac Broadcom WiFi PCIe driver exposes systems running kernel 5.2 and later to potential kernel heap corruption when a bus_reset event is sequentially followed by device removal. The flaw in brcmf_pcie_release_scratchbuffers() allows dma_free_coherent() to be called twice on the same DMA allocation because freed pointer fields are not NULLed - unlike the sibling release_ringbuffers() function which correctly NULLs its pointers. No public exploit code exists and EPSS exploitation probability is very low (0.21%, 11th percentile), though the high CVSS score (8.8) reflects the theoretical severity of kernel-level memory corruption if the double-free is successfully weaponized.

Technical ContextAI

The vulnerability resides in drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c within the Linux kernel's Broadcom FullMAC WiFi driver. During driver initialization, brcmf_pcie_shared_ring_init() allocates two coherent DMA buffers: shared.scratch and shared.ringupd, via dma_alloc_coherent(). The sibling teardown function release_ringbuffers() correctly assigns NULL to its pointer fields (commonrings, flowrings, idxbuf) after calling dma_free_coherent(), making it idempotent. brcmf_pcie_release_scratchbuffers() omits this NULL-assignment step entirely. Two separate code paths - brcmf_pcie_reset() (the bus_reset .reset callback) and brcmf_pcie_remove() (full driver teardown) - both invoke release_scratchbuffers(). When reset teardown precedes removal, the second call passes a stale non-NULL pointer to dma_free_coherent(), constituting a CWE-415 Double Free in coherent DMA memory. The root cause is an inconsistent resource release pattern within the same driver module. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, covering all unpatched kernel builds shipping the brcmfmac PCIe driver since commit 4684997d9eea (kernel 5.2).

RemediationAI

The definitive fix is upgrading the Linux kernel to a patched stable release: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 depending on which stable branch is deployed. Upstream fix commits are published at https://git.kernel.org/stable/c/5a045c2f0fbf029873d2295178fa0785ade35af0, https://git.kernel.org/stable/c/b7d1d8cb1bdca56aecebacd2896615da0acc126a, https://git.kernel.org/stable/c/044fca8f45ba9ab6ca526163155234cf88287ff5, https://git.kernel.org/stable/c/0ca80328df23f851c86866720d4977783c919ee6, and https://git.kernel.org/stable/c/538c51e9d124cf656f2dd0c0394a8545efc7102d. Distribution-specific kernel updates for Debian, Ubuntu, RHEL, SUSE, and others will incorporate these fixes; consult the respective distribution security tracker for exact package versions. Where immediate kernel upgrade is not feasible, the brcmfmac module can be blacklisted to eliminate the attack surface entirely: run 'modprobe -r brcmfmac' and add 'blacklist brcmfmac' to /etc/modprobe.d/blacklist.conf followed by 'update-initramfs -u'. The trade-off is complete loss of Broadcom PCIe WiFi functionality; this is acceptable only in environments where WiFi is non-operational or a replacement adapter is available. No partial workaround (e.g., restricting WiFi channels) meaningfully reduces exploitability given the driver-lifecycle nature of the trigger.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68192 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68192

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code