UBUNTU-CVE-2026-74706: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit(), which eventually invokes bngeauxdevrelease(). The release callback unconditionally dereferences auxpriv->auxrdev->pdev to retrieve the parent bngedev. Since auxrdev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception Retrieve the parent bngedev from the auxiliary device's parent instead of auxrdev, and free auxrdev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue applies to the listed Ubuntu Linux kernel packages: linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. Exposure requires use of the bnge driver and its auxiliary-device setup path.
What condition triggers the NULL pointer dereference?
The fault occurs when allocation of auxr_dev fails during auxiliary device setup. The resulting cleanup path invokes the release callback, which dereferences aux_priv->auxr_dev even though that object was not allocated.
Is this reachable during normal successful device initialization?
The described failure is specific to an allocation-failure error path during auxiliary device setup. The provided information does not indicate that normally successful initialization triggers the dereference.
How can administrators determine whether they may be affected?
Identify whether a listed Ubuntu kernel package is in use and whether the bnge driver is used on the system. The relevant symptom is a NULL pointer exception occurring during failed auxiliary-device initialization.