Linux Kernel Patches WiFi Heap Overflow, BPF Bypass
August 15 kernel stable drop fixes a Broadcom WiFi heap overflow triggerable by a rogue AP, a BPF verifier bypass, and 28 other security fixes.
Morgan "airgap" ReyesThirty-plus Linux kernel CVEs landed on NVD on August 15. Most are maintenance-level. Four are security-relevant.
All four listed below are published and confirmed on NVD as of August 15, 2026. No CVSS scores have been assigned yet — severity assessments are based on the described impact in each NVD entry, not editorial guess.
CVE-2026-72003 — brcmfmac WiFi heap overflow
Source: NVD entry for CVE-2026-72003, published 2026-08-15.
The Broadcom WiFi driver (brcmfmac) processes 802.11 auth frames without enforcing a minimum length before reading fixed-size fields from the frame body. When mgmt_frame_len is below the management header offset (24 bytes), an unsigned subtraction wraps to a very large value and the subsequent memcpy runs far past the allocated kernel buffer.
Attack precondition: a malicious or malfunctioning access point sends a short auth frame during an external SAE auth exchange. Per the NVD description: “A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow.” Physical proximity to the rogue AP is required. No prior authentication or credentials are needed.
Affected: systems running the upstream brcmfmac driver. Broadcom 802.11 chips are common in consumer laptops, embedded devices, and single-board computers. Patch is in stable.
CVE-2026-68479 — Bluetooth btrtl firmware bounds
Source: NVD entry for CVE-2026-68479, published 2026-08-15.
The Realtek Bluetooth firmware loader (btrtl) copies firmware patch data without verifying that the patch is long enough to contain the version suffix it subsequently appends. A malformed firmware image shorter than the version field underflows the length calculation, producing an oversized heap read and write during Bluetooth device setup.
Attack vector is the firmware image, not over-the-air. Relevant threat models: supply-chain tampering or local firmware replacement. Lower immediacy than CVE-2026-72003.
CVE-2026-68462 — BPF verifier negative constant offset
Source: NVD entry for CVE-2026-68462, published 2026-08-15.
The eBPF verifier correctly blocked variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses but accepted constant negative offsets produced by pointer arithmetic — a gap created when commit 022ac0750883 moved constant offsets from reg->off to reg->var_off. A crafted BPF program with a constant offset of, for example, -8 and an instruction offset of zero would pass verification and load cleanly.
The BPF sandbox verifier is the primary isolation boundary for untrusted BPF programs. Out-of-bounds paths through the verifier have historically produced local privilege escalation. This patch closes one such path.
CVE-2026-72014 — DRBD peer-supplied size underflow
Source: NVD entry for CVE-2026-72014, published 2026-08-15.
The DRBD distributed block device driver processes data reply frames from peers. Per NVD: “two peer-controlled inputs can make [data_size] negative” — either a digest underflow when an integrity algorithm is in use, or an integer truncation from the wire length field in the default configuration. The subsequent I/O call then runs with a size of SIZE_MAX, corrupting kernel memory past the first mapped page.
A diskless DRBD node or one using read-balancing to a peer is exposed in the default configuration. Requires a compromised, malicious, or man-in-the-middle DRBD peer.
No exploitation confirmed in the wild for any of these four — unconfirmed, treat accordingly. No CISA KEV additions for this batch as of publication. Update to the latest stable kernel; the fixes are in stable.
Priority order for patching: CVE-2026-72003 first — proximity-triggerable WiFi heap overflows have historically had short timelines between disclosure and weaponization.
Found this useful? Share it.
