CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices
In the Linux kernel, the following vulnerability has been resolved:
bnxten: Handle partially initialized auxiliary devices
bnxtauxdevicesinit() calls auxiliarydeviceinit() before all fields used by bnxtauxdevrelease() are initialized. After auxiliarydeviceinit() succeeds, later errors must unwind with auxiliarydeviceuninit(), which invokes the release callback.
The release callback assumes that auxpriv->id, auxpriv->edev, edev->net and edev->ulptbl are all populated. If allocation fails after auxiliarydeviceinit(), the release path can otherwise dereference or clear partially initialized state.
Allocate and attach the bnxtendev and ULP table before calling auxiliarydeviceinit(), so the release callback only sees a fully initialized auxiliary private object. If auxiliarydeviceinit() itself fails, free those allocations directly because deviceinitialize() has not run and the release callback will not be invoked.
This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68375?
CVE-2026-68375 has a severity rating of 27.
How do I fix CVE-2026-68375?
To fix CVE-2026-68375, update the Linux kernel to the latest version where the vulnerability has been patched.
What causes CVE-2026-68375?
CVE-2026-68375 is caused by the bnxt_aux_devices_init() function calling auxiliary_device_init() before all necessary fields are fully initialized.
Which software is affected by CVE-2026-68375?
CVE-2026-68375 affects the Linux kernel, specifically the bnxt_en driver.
When was CVE-2026-68375 published?
CVE-2026-68375 was published on August 10, 2026.