UBUNTU-CVE-2026-68375: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit() calls auxiliarydeviceinit() before all fields used by bnxtauxdevrelease() are initialized. After auxiliarydeviceinit() succeeds, later errors must unwind with auxiliarydeviceuninit(), which invokes the release callback. The release callback assumes that auxpriv->id, auxpriv->edev, edev->net and edev->ulptbl are all populated. If allocation fails after auxiliarydeviceinit(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxtendev and ULP table before calling auxiliarydeviceinit(), so the release callback only sees a fully initialized auxiliary private object. If auxiliarydeviceinit() itself fails, free those allocations directly because deviceinitialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In bnxt_aux_devices_init(), allocate and attach bnxt_en_dev and the ULP table before calling auxiliary_device_init(); if auxiliary_device_init() succeeds, unwind later errors with auxiliary_device_uninit(), and if auxiliary_device_init() fails, free those allocations directly because the release callback is not invoked.
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are identified as affected?
The issue is listed for ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What condition reaches the unsafe cleanup path?
The problematic path occurs when allocation fails after auxiliary_device_init() has succeeded. Cleanup then invokes the auxiliary-device release callback while parts of the auxiliary private object may not yet be initialized.
What does the resolved code change do to prevent the issue?
It allocates and attaches the bnxt_en_dev and ULP table before calling auxiliary_device_init(), ensuring the release callback sees a fully initialized object. If auxiliary_device_init() fails, those allocations are freed directly because the release callback will not run.