CVE-2026-74706: bnge: Fix NULL pointer dereference in aux device release
In the Linux kernel, the following vulnerability has been resolved:
bnge: Fix NULL pointer dereference in aux device release
If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit(), which eventually invokes bngeauxdevrelease().
The release callback unconditionally dereferences auxpriv->auxrdev->pdev to retrieve the parent bngedev. Since auxrdev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception
Retrieve the parent bngedev from the auxiliary device's parent instead of auxrdev, and free auxrdev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices.
Affected Software
Event History
Frequently Asked Questions
Under what condition can this issue be triggered?
It occurs when allocation of auxr_dev fails during auxiliary device setup. The subsequent cleanup path invokes the auxiliary-device release callback while auxr_dev is still NULL.
What is the practical impact of the failure?
The release callback dereferences aux_priv->auxr_dev->pdev even though auxr_dev was not allocated, causing a NULL pointer exception during cleanup of a partially initialized auxiliary device.
How does the fix prevent the crash?
The fix obtains the parent bnge_dev from the auxiliary device's parent rather than from auxr_dev. It also frees auxr_dev only if its allocation succeeded.