# CVE-2026-68403: wifi: brcmfmac: initialize SDIO data work before cleanup

Status: published. Published: 2026-08-10. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: initialize SDIO data work before cleanup

brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before
allocating the ordered workqueue. If that allocation fails, the function
jumps to fail and calls brcmf_sdio_remove().

brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the
work item before the first failure path that can reach brcmf_sdio_remove(),
so the cleanup path always observes a valid work object.

This issue was found by our static analysis tool and then confirmed by
manual review of the probe error path and the remove-time work drain. The
problem pattern is an early setup failure that reaches a cleanup helper
which cancels an embedded work item before its initializer has run.

A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in
brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The
resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports
the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in
the stack.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < 860887d22890417d43ef8298f0cc4865e29b54de (affected, git); ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < 9a4be91e5bb032b34cb3c962f6d4f82e7ef09364 (affected, git); ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < fb12c87ae855346321af72e57a93c146205f1090 (affected, git); ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < f50a2b9e57a751e70ae9a272875d80d39eaccd6a (affected, git); ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < 6bd21ec8549a5854dd64204a66289952917a924c (affected, git); ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < 5c342437ea44bb829680ca9e4f683dd5b325b219 (affected, git); ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < c73c3fc1c7ca5a927639f0884624cb244ba791e4 (affected, git); ≥ 9982464379e81ece51ced03ebecbbcd34ea367a6; < 2a665946e0407a05a3f81bd56a08553c446498e0 (affected, git). Source: CNA: Linux
- Linux / Linux: 4.1 (affected); ≥ 0; < 4.1 (unaffected, semver); ≥ 5.10.265; ≤ 5.10.* (unaffected, semver); ≥ 5.15.216; ≤ 5.15.* (unaffected, semver); ≥ 6.1.183; ≤ 6.1.* (unaffected, semver); ≥ 6.6.148; ≤ 6.6.* (unaffected, semver); ≥ 6.12.101; ≤ 6.12.* (unaffected, semver); ≥ 6.18.42; ≤ 6.18.* (unaffected, semver); ≥ 7.1.6; ≤ 7.1.* (unaffected, semver); ≥ 7.2; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.18% as of 2026-11-06; percentile 7.25%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/860887d22890417d43ef8298f0cc4865e29b54de (CNA: Linux)

- https://git.kernel.org/stable/c/9a4be91e5bb032b34cb3c962f6d4f82e7ef09364 (CNA: Linux)

- https://git.kernel.org/stable/c/fb12c87ae855346321af72e57a93c146205f1090 (CNA: Linux)

- https://git.kernel.org/stable/c/f50a2b9e57a751e70ae9a272875d80d39eaccd6a (CNA: Linux)

- https://git.kernel.org/stable/c/6bd21ec8549a5854dd64204a66289952917a924c (CNA: Linux)

- https://git.kernel.org/stable/c/5c342437ea44bb829680ca9e4f683dd5b325b219 (CNA: Linux)

- https://git.kernel.org/stable/c/c73c3fc1c7ca5a927639f0884624cb244ba791e4 (CNA: Linux)

- https://git.kernel.org/stable/c/2a665946e0407a05a3f81bd56a08553c446498e0 (CNA: Linux)

- https://git.kernel.org/stable/c/2a665946e0407a05a3f81bd56a08553c446498e0 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/5c342437ea44bb829680ca9e4f683dd5b325b219 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/6bd21ec8549a5854dd64204a66289952917a924c (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/860887d22890417d43ef8298f0cc4865e29b54de (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/9a4be91e5bb032b34cb3c962f6d4f82e7ef09364 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/c73c3fc1c7ca5a927639f0884624cb244ba791e4 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/f50a2b9e57a751e70ae9a272875d80d39eaccd6a (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

- https://git.kernel.org/stable/c/fb12c87ae855346321af72e57a93c146205f1090 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-68403; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68403; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-68403; retrieved 2026-11-06; source updated Not reported

Revision: ab91072c995f0bbec2e6ebfa281c6a75a084a19427b3988b2ae58503e87a968d

Canonical: https://y2.dev/cve/CVE-2026-68403

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.