SB20260812128 - Improper Initialization in Linux kernel brcm80211 brcmfmac driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-68403)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper initialization in brcmf_sdio_probe() and brcmf_sdio_remove() when handling an early probe failure during SDIO device initialization. A local attacker can trigger a workqueue allocation failure to cause a denial of service.

The issue occurs because the cleanup path cancels bus->datawork before the work item has been initialized.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2a665946e0407a05a3f81bd56a08553c446498e0
• https://git.kernel.org/stable/c/5c342437ea44bb829680ca9e4f683dd5b325b219
• https://git.kernel.org/stable/c/6bd21ec8549a5854dd64204a66289952917a924c
• https://git.kernel.org/stable/c/c73c3fc1c7ca5a927639f0884624cb244ba791e4
• https://git.kernel.org/stable/c/f50a2b9e57a751e70ae9a272875d80d39eaccd6a