CVE-2026-68192: wifi: brcmfmac: make release_scratchbuffers idempotent

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: make release_scratchbuffers idempotent

brcmf_pcie_release_scratchbuffers() frees the shared.scratch and
shared.ringupd DMA buffers with dma_free_coherent() but does not clear
the pointers afterwards, unlike the sibling release_ringbuffers() which
NULLs commonrings/flowrings/idxbuf on release.

Both the bus_reset .reset callback (brcmf_pcie_reset) and
brcmf_pcie_remove() call release_scratchbuffers.  When reset teardown
has run before removal, remove's own teardown would call
dma_free_coherent() a second time on the already-freed DMA allocation.

NULL the pointers after free, matching release_ringbuffers(), so a later
release observes that the allocation has already been released.  This
patch makes repeated sequential release safe; the reset-work lifetime is
handled separately by the following patch.

This issue was found by an in-house static analysis tool.

The Linux kernel CVE team has assigned CVE-2026-68192 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.2 with commit 4684997d9eea29380000e062755aa6d368d789a3 and fixed in 6.6.148 with commit b7d1d8cb1bdca56aecebacd2896615da0acc126a
	Issue introduced in 5.2 with commit 4684997d9eea29380000e062755aa6d368d789a3 and fixed in 6.12.101 with commit 5a045c2f0fbf029873d2295178fa0785ade35af0
	Issue introduced in 5.2 with commit 4684997d9eea29380000e062755aa6d368d789a3 and fixed in 6.18.42 with commit 044fca8f45ba9ab6ca526163155234cf88287ff5
	Issue introduced in 5.2 with commit 4684997d9eea29380000e062755aa6d368d789a3 and fixed in 7.1.6 with commit 0ca80328df23f851c86866720d4977783c919ee6
	Issue introduced in 5.2 with commit 4684997d9eea29380000e062755aa6d368d789a3 and fixed in 7.2-rc5 with commit 538c51e9d124cf656f2dd0c0394a8545efc7102d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68192
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b7d1d8cb1bdca56aecebacd2896615da0acc126a
	https://git.kernel.org/stable/c/5a045c2f0fbf029873d2295178fa0785ade35af0
	https://git.kernel.org/stable/c/044fca8f45ba9ab6ca526163155234cf88287ff5
	https://git.kernel.org/stable/c/0ca80328df23f851c86866720d4977783c919ee6
	https://git.kernel.org/stable/c/538c51e9d124cf656f2dd0c0394a8545efc7102d