CVE-2026-89582: bnx2x: fix double free in bnx2x_init_firmware() error path
bnx2x: fix double free in bnx2xinitfirmware() error path
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Configuration
In bnx2x_init_firmware() error path, after kfree() free bp->init_ops, bp->init_data, and bp->init_ops_offsets, immediately set each of those pointers to NULL so that later cleanup via bnx2x_release_firmware() does not double free them.
Linux kernel (bnx2x driver) Error-path cleanup after kfree() = Set freed pointers (bp->init_ops, bp->init_data, bp->init_ops_offsets) to NULL after kfree()
Event History
Frequently Asked Questions
What conditions are required for the double free to occur?
bnx2x_init_firmware() must first fail after allocating one or more of bp->init_ops, bp->init_data, or bp->init_ops_offsets. A later call to bnx2x_release_firmware(), including during device removal or via the function state machine, then attempts to free the same pointers again.
Which systems are exposed?
Systems using the Linux kernel bnx2x driver are potentially exposed when the firmware initialization error path is reached and subsequent cleanup occurs. The provided information does not identify affected hardware models, kernel versions, or configuration defaults.
How can administrators determine whether their kernel includes the fix?
Check whether the kernel source or applied stable patches include one of the referenced commits. The fix sets bp->init_ops, bp->init_data, and bp->init_ops_offsets to NULL immediately after they are freed in the bnx2x_init_firmware() error path.