CVE-2026-68304 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning
Based on wpa_auth as 1x_256 mode, need to set up "use_fwsup" with BRCMF_PROFILE_FWSUP_1X. Or it will happen trace warning when call brcmf_cfg80211_set_pmk().
[ 4481.831101] ------------[ cut here ]------------
[ 4481.831102] WARNING: CPU: 1 PID: 2997 at
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:7242 brcmf_cfg80211_set_pmk+0x77/0xd0 [brcmfmac]
[...]
[ 4481.831202] Call Trace:
[ 4481.831204] <TASK>
[ 4481.831205] nl80211_set_pmk+0x183/0x250 [cfg80211]
[ 4481.831233] genl_family_rcv_msg_doit+0xea/0x150
[ 4481.831237] genl_rcv_msg+0x104/0x240
[ 4481.831239] ? cfg80211_probe_status+0x2c0/0x2c0 [cfg80211]
[ 4481.831257] ? genl_family_rcv_msg_doit+0x150/0x150
[ 4481.831259] netlink_rcv_skb+0x4e/0x100
[ 4481.831261] genl_rcv+0x24/0x40
[ 4481.831262] netlink_unicast+0x236/0x380
[ 4481.831264] netlink_sendmsg+0x250/0x4b0
[ 4481.831266] sock_sendmsg+0x5c/0x70
[ 4481.831269] ____sys_sendmsg+0x236/0x2b0
[ 4481.831271] ? copy_msghdr_from_user+0x6d/0xa0
[ 4481.831272] ___sys_sendmsg+0x86/0xd0
[ 4481.831274] ? avc_has_perm+0x8c/0x1a0
[ 4481.831276] ? preempt_count_add+0x6a/0xa0
[ 4481.831279] ? sock_has_perm+0x82/0xa0
[ 4481.831280] __sys_sendmsg+0x57/0xa0
[ 4481.831282] do_syscall_64+0x38/0x90
[ 4481.831284] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 4481.831286] RIP: 0033:0x7fd270d369b4
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the brcmfmac driver component of the Linux kernel, specifically affecting wireless networking functionality related to 802.1X authentication with SHA256 encryption. This issue manifests as a warning trace when the kernel attempts to set a PMK (Pairwise Master Key) through the brcmf_cfg80211_set_pmk() function. The problem occurs in the context of wireless network authentication where the driver fails to properly configure the firmware-supplied 802.1X mode, specifically when operating in 1x_256 mode. According to the kernel's wireless subsystem architecture and security protocols, this represents a failure in proper state management during the 802.1X authentication handshake process.
The technical flaw stems from an incomplete initialization of the firmware-supplied 802.1X profile flags within the brcmfmac driver. When wpa_auth operates in 1x_256 mode, it requires explicit configuration of the "use_fwsup" parameter with BRCMF_PROFILE_FWSUP_1X flag to properly handle SHA256-based authentication. Without this proper initialization, the driver attempts to process PMK settings without the necessary firmware context, leading to a kernel warning trace that indicates improper state handling in the cfg80211 wireless configuration subsystem. This vulnerability falls under CWE-254, representing a security weakness in the implementation of access control mechanisms, and specifically aligns with ATT&CK technique T1566 for credential access through wireless network manipulation.
The operational impact of this vulnerability extends beyond simple warning messages as it can potentially disrupt wireless authentication processes and compromise the integrity of 802.1X-based secure wireless connections. Systems utilizing Broadcom wireless drivers in environments requiring strong authentication, particularly those implementing SHA256-based 802.1X methods, may experience intermittent connection failures or degraded security posture. The warning trace indicates that this occurs during critical kernel operations involving netlink communication and generic netlink family message processing, suggesting potential issues with driver stability and wireless network management capabilities. This vulnerability affects systems running Linux kernels with brcmfmac driver versions where the specific firmware-supplied 802.1X profile initialization logic has not been properly implemented.
Mitigation strategies for this vulnerability require patching the kernel to ensure proper initialization of the BRCMF_PROFILE_FWSUP_1X flag when operating in 1x_256 mode. System administrators should update their kernel versions to include the fix that properly configures the firmware-supplied 802.1X profile flags before attempting to establish secure wireless connections using SHA256 authentication methods. Additionally, monitoring systems should be configured to detect and alert on similar kernel warning traces that may indicate improper driver state management during wireless authentication processes. The fix ensures that when wpa_auth operates in 1x_256 mode, the brcmfmac driver correctly initializes the use_fwsup parameter, preventing the call trace warning and ensuring proper operation of 802.1X authentication with SHA256 encryption while maintaining compliance with wireless security standards and protocols defined by IEEE 802.11i and related specifications.