CVE-2026-74706

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception Retrieve the parent bnge_dev from the auxiliary device's parent instead of auxr_dev, and free auxr_dev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/1cb4298810e27e037d3ca07286ecbb97e89ba58d
https://git.kernel.org/stable/c/83ef2f3cab7fe6dd9155cd598dc64be524d963a9

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-22 16:16

Updated : 2026-08-22 16:16

NVD link : CVE-2026-74706

Mitre link : CVE-2026-74706

CVE.ORG link : CVE-2026-74706

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74706", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554", "lessThan": "83ef2f3cab7fe6dd9155cd598dc64be524d963a9", "versionType": "git"}, {"status": "affected", "version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554", "lessThan": "1cb4298810e27e037d3ca07286ecbb97e89ba58d", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"], "defaultStatus": "affected"}]}], "published": "2026-08-22T16:16:45.333", "references": [{"url": "https://git.kernel.org/stable/c/1cb4298810e27e037d3ca07286ecbb97e89ba58d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/83ef2f3cab7fe6dd9155cd598dc64be524d963a9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnge: Fix NULL pointer dereference in aux device release\n\nIf allocation of auxr_dev fails during auxiliary device setup, the error\npath calls auxiliary_device_uninit(), which eventually invokes\nbnge_aux_dev_release().\n\nThe release callback unconditionally dereferences aux_priv->auxr_dev->pdev\nto retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated\non this failure path, the dereference results in a NULL pointer exception\n\nRetrieve the parent bnge_dev from the auxiliary device's parent instead of\nauxr_dev, and free auxr_dev only when it was successfully allocated. This\nallows the release callback to correctly clean up partially initialized\nauxiliary devices."}], "lastModified": "2026-08-22T16:16:45.333", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}