CVE-2026-68192

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: make release_scratchbuffers idempotent

brcmfpciereleasescratchbuffers() frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent() but does not clear the pointers afterwards, unlike the sibling releaseringbuffers() which NULLs commonrings/flowrings/idxbuf on release.

Both the busreset .reset callback (brcmfpciereset) and brcmfpcieremove() call releasescratchbuffers. When reset teardown has run before removal, remove's own teardown would call dmafreecoherent() a second time on the already-freed DMA allocation.

NULL the pointers after free, matching release_ringbuffers(), so a later release observes that the allocation has already been released. This patch makes repeated sequential release safe; the reset-work lifetime is handled separately by the following patch.

This issue was found by an in-house static analysis tool.