CVE-2026-74706

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74706", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.927Z", "datePublished": "2026-08-22T15:33:04.723Z", "dateUpdated": "2026-08-22T15:33:04.723Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:33:04.723Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnge: Fix NULL pointer dereference in aux device release\n\nIf allocation of auxr_dev fails during auxiliary device setup, the error\npath calls auxiliary_device_uninit(), which eventually invokes\nbnge_aux_dev_release().\n\nThe release callback unconditionally dereferences aux_priv->auxr_dev->pdev\nto retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated\non this failure path, the dereference results in a NULL pointer exception\n\nRetrieve the parent bnge_dev from the auxiliary device's parent instead of\nauxr_dev, and free auxr_dev only when it was successfully allocated. This\nallows the release callback to correctly clean up partially initialized\nauxiliary devices."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"], "versions": [{"version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554", "lessThan": "83ef2f3cab7fe6dd9155cd598dc64be524d963a9", "status": "affected", "versionType": "git"}, {"version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554", "lessThan": "1cb4298810e27e037d3ca07286ecbb97e89ba58d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/83ef2f3cab7fe6dd9155cd598dc64be524d963a9"}, {"url": "https://git.kernel.org/stable/c/1cb4298810e27e037d3ca07286ecbb97e89ba58d"}], "title": "bnge: Fix NULL pointer dereference in aux device release", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "83ef2f3cab7fe6dd9155cd598dc64be524d963a9", "status": "affected", "version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554", "versionType": "git"}, {"lessThan": "1cb4298810e27e037d3ca07286ecbb97e89ba58d", "status": "affected", "version": "8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnge: Fix NULL pointer dereference in aux device release\n\nIf allocation of auxr_dev fails during auxiliary device setup, the error\npath calls auxiliary_device_uninit(), which eventually invokes\nbnge_aux_dev_release().\n\nThe release callback unconditionally dereferences aux_priv->auxr_dev->pdev\nto retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated\non this failure path, the dereference results in a NULL pointer exception\n\nRetrieve the parent bnge_dev from the auxiliary device's parent instead of\nauxr_dev, and free auxr_dev only when it was successfully allocated. This\nallows the release callback to correctly clean up partially initialized\nauxiliary devices."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbnge: Correcci\u00f3n de desreferencia de puntero NULL en la liberaci\u00f3n de dispositivo auxiliar\n\nSi la asignaci\u00f3n de auxr_dev falla durante la configuraci\u00f3n del dispositivo auxiliar, la ruta de error llama a auxiliary_device_uninit(), que finalmente invoca a bnge_aux_dev_release().\n\nLa devoluci\u00f3n de llamada de liberaci\u00f3n desreferencia incondicionalmente aux_priv -> auxr_dev -> pdev para recuperar el bnge_dev padre. Dado que auxr_dev a\u00fan no ha sido asignado en esta ruta de fallo, la desreferencia resulta en una excepci\u00f3n de puntero NULL.\n\nRecuperar el bnge_dev padre del padre del dispositivo auxiliar en lugar de auxr_dev, y liberar auxr_dev solo cuando fue asignado exitosamente. Esto permite a la devoluci\u00f3n de llamada de liberaci\u00f3n limpiar correctamente los dispositivos auxiliares parcialmente inicializados."}], "id": "CVE-2026-74706", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:45.333", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1cb4298810e27e037d3ca07286ecbb97e89ba58d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83ef2f3cab7fe6dd9155cd598dc64be524d963a9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bnge: Fix NULL pointer dereference in aux device release", "id": "2521443", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521443"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbnge: Fix NULL pointer dereference in aux device release\nIf allocation of auxr_dev fails during auxiliary device setup, the error\npath calls auxiliary_device_uninit(), which eventually invokes\nbnge_aux_dev_release().\nThe release callback unconditionally dereferences aux_priv->auxr_dev->pdev\nto retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated\non this failure path, the dereference results in a NULL pointer exception\nRetrieve the parent bnge_dev from the auxiliary device's parent instead of\nauxr_dev, and free auxr_dev only when it was successfully allocated. This\nallows the release callback to correctly clean up partially initialized\nauxiliary devices.", "A flaw was found in the Linux kernel's bnge driver. During the setup of an auxiliary device, if the allocation of a specific resource (`auxr_dev`) fails, the subsequent release process attempts to access an unallocated memory region. This results in a NULL pointer dereference, which can lead to a system crash, causing a Denial of Service (DoS)."], "name": "CVE-2026-74706", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74706\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74706\nhttps://lore.kernel.org/linux-cve-announce/2026082237-CVE-2026-74706-889b@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554,83ef2f3cab7fe6dd9155cd598dc64be524d963a9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554,1cb4298810e27e037d3ca07286ecbb97e89ba58d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:15:03.689991+00:00", "updated": "2026-08-25T14:45:03.957131+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}