CVE-2026-74734: firewire: ohci: fix NULL pointer dereference in ar_context_release
In the Linux kernel, the following vulnerability has been resolved:
firewire: ohci: fix NULL pointer dereference in arcontextrelease
During the error handling path of the driver's probe function, a NULL pointer dereference can occur in arcontextrelease().
When pciprobe() fails early (e.g., if pcimenabledevice() or MMIO mapping fails), the devres cleanup mechanism invokes releaseohci(). This function unconditionally calls arcontextrelease() to clean up the asynchronous receive contexts. However, if arcontextinit() was not yet called, ctx->ohci remains NULL (as the fwohci structure is zero-initialized by devresalloc()).
arcontextrelease() immediately dereferences ctx->ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:arcontextrelease+0x3f/0x380 drivers/firewire/ohci.c:543 Call Trace: releaseohci+0x3f/0x60 drivers/firewire/ohci.c:3567 releasenodes drivers/base/devres.c:546 [inline] devresreleaseall+0x1a8/0x260 drivers/base/devres.c:576 deviceunbindcleanup drivers/base/dd.c:597 [inline] reallyprobe+0x451/0xae0 drivers/base/dd.c:772
To fix this, move the assignment of the dev pointer after the !ctx->buffer check. If ctx->buffer is NULL, it indicates that the context was never successfully initialized and there is nothing to release, safely avoiding the dereference of the uninitialized ctx->ohci pointer.
Affected Software
Event History
Frequently Asked Questions
When can this crash occur?
The crash can occur during the FireWire OHCI driver's probe error-handling path when PCI probing fails before asynchronous receive contexts have been initialized. Examples given include failure of pcim_enable_device() or MMIO mapping.
What is the practical impact of triggering the issue?
The devres cleanup path invokes release_ohci(), which calls ar_context_release() with an uninitialized context. Because ctx->ohci is NULL and is dereferenced before initialization is checked, this can crash the kernel.
How can I determine whether a system has encountered this issue?
Look for a kernel Oops or general protection fault during FireWire OHCI device probing or cleanup, with ar_context_release(), release_ohci(), and devres cleanup functions in the call trace. The reported fault is a NULL-pointer dereference in ar_context_release().
What change resolves the problem?
Apply a Linux kernel update containing the fix referenced by the listed stable kernel commits. The fix addresses the NULL pointer dereference in ar_context_release() during early probe failure cleanup.