CVE-2026-89582: bnx2x: fix double free in bnx2x_init_firmware() error path
In the Linux kernel, the following vulnerability has been resolved:
bnx2x: fix double free in bnx2xinitfirmware() error path
bnx2xinitfirmware() frees bp->initops, bp->initdata and bp->initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware() frees the same three pointers unconditionally, so if initfirmware fails and releasefirmware is later called (e.g. from bnx2xremove or through the function state machine), all three are freed a second time.
Set each pointer to NULL after kfree() in the error path so that the subsequent kfree(NULL) in bnx2xreleasefirmware() is a safe no-op.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In bnx2x_init_firmware() error path, after kfree() free bp->init_ops, bp->init_data, and bp->init_ops_offsets, immediately set each of those pointers to NULL so that later cleanup via bnx2x_release_firmware() does not double free them.
Linux kernel (bnx2x driver) Error-path cleanup after kfree() = Set freed pointers (bp->init_ops, bp->init_data, bp->init_ops_offsets) to NULL after kfree()
Event History
Frequently Asked Questions
What conditions are required for the double free to occur?
bnx2x_init_firmware() must first fail after allocating one or more of bp->init_ops, bp->init_data, or bp->init_ops_offsets. A later call to bnx2x_release_firmware(), including during device removal or via the function state machine, then attempts to free the same pointers again.
Which systems are exposed?
Systems using the Linux kernel bnx2x driver are potentially exposed when the firmware initialization error path is reached and subsequent cleanup occurs. The provided information does not identify affected hardware models, kernel versions, or configuration defaults.
How can administrators determine whether their kernel includes the fix?
Check whether the kernel source or applied stable patches include one of the referenced commits. The fix sets bp->init_ops, bp->init_data, and bp->init_ops_offsets to NULL immediately after they are freed in the bnx2x_init_firmware() error path.