---
id: CVE-2026-68403
title: 'wifi: brcmfmac: initialize SDIO data work before cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: brcmfmac: initialize SDIO data work before cleanup

  brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before
  allocating the ordered workqueue. If …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    860887d22890417d43ef8298f0cc4865e29b54de
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    9a4be91e5bb032b34cb3c962f6d4f82e7ef09364
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    fb12c87ae855346321af72e57a93c146205f1090
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    f50a2b9e57a751e70ae9a272875d80d39eaccd6a
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    6bd21ec8549a5854dd64204a66289952917a924c
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    5c342437ea44bb829680ca9e4f683dd5b325b219
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    c73c3fc1c7ca5a927639f0884624cb244ba791e4
  - >-
    Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 <
    2a665946e0407a05a3f81bd56a08553c446498e0
  - Linux 4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:48:39.275130Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:15.413Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68403'
references:
  - url: 'https://git.kernel.org/stable/c/860887d22890417d43ef8298f0cc4865e29b54de'
  - url: 'https://git.kernel.org/stable/c/9a4be91e5bb032b34cb3c962f6d4f82e7ef09364'
  - url: 'https://git.kernel.org/stable/c/fb12c87ae855346321af72e57a93c146205f1090'
  - url: 'https://git.kernel.org/stable/c/f50a2b9e57a751e70ae9a272875d80d39eaccd6a'
  - url: 'https://git.kernel.org/stable/c/6bd21ec8549a5854dd64204a66289952917a924c'
  - url: 'https://git.kernel.org/stable/c/5c342437ea44bb829680ca9e4f683dd5b325b219'
  - url: 'https://git.kernel.org/stable/c/c73c3fc1c7ca5a927639f0884624cb244ba791e4'
  - url: 'https://git.kernel.org/stable/c/2a665946e0407a05a3f81bd56a08553c446498e0'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.0725
ingestedAt: '2026-11-06T18:00:12.605Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: initialize SDIO data work before cleanup

brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before
allocating the ordered workqueue. If that allocation fails, the function
jumps to fail and calls brcmf_sdio_remove().

brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the
work item before the first failure path that can reach brcmf_sdio_remove(),
so the cleanup path always observes a valid work object.

This issue was found by our static analysis tool and then confirmed by
manual review of the probe error path and the remove-time work drain. The
problem pattern is an early setup failure that reaches a cleanup helper
which cancels an embedded work item before its initializer has run.

A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in
brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The
resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports
the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in
the stack.

## Affected

- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < 860887d22890417d43ef8298f0cc4865e29b54de`
- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < 9a4be91e5bb032b34cb3c962f6d4f82e7ef09364`
- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < fb12c87ae855346321af72e57a93c146205f1090`
- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < f50a2b9e57a751e70ae9a272875d80d39eaccd6a`
- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < 6bd21ec8549a5854dd64204a66289952917a924c`
- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < 5c342437ea44bb829680ca9e4f683dd5b325b219`
- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < c73c3fc1c7ca5a927639f0884624cb244ba791e4`
- `Linux >= 9982464379e81ece51ced03ebecbbcd34ea367a6 < 2a665946e0407a05a3f81bd56a08553c446498e0`
- `Linux 4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.