CVE-2026-68375
Received Received - Intake

Memory Leak in Linux Kernel bnxt_en Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle partially initialized auxiliary devices bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback. The release callback assumes that aux_priv->id, aux_priv->edev, edev->net and edev->ulp_tbl are all populated. If allocation fails after auxiliary_device_init(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxt_en_dev and ULP table before calling auxiliary_device_init(), so the release callback only sees a fully initialized auxiliary private object. If auxiliary_device_init() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68375
EUVD
EUVD-2026-55561

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bnxt bnxt_en *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper initialization of auxiliary devices in the bnxt_en driver. The issue occurs when bnxt_aux_devices_init() calls auxiliary_device_init() before all required fields are set. If initialization fails later, the cleanup process may access partially initialized data, leading to potential dereferencing of invalid or corrupted state.

Detection Guidance

This vulnerability is specific to the Linux kernel's bnxt_en driver and requires kernel source code analysis or runtime detection via kernel logs. Check for errors related to bnxt_aux_devices_init() or auxiliary device initialization failures in system logs using commands like dmesg | grep bnxt or journalctl -k | grep bnxt.

Impact Analysis

This vulnerability could cause system instability or crashes if the bnxt_en driver fails during initialization. Attackers might exploit this to trigger denial-of-service conditions or execute arbitrary code in the kernel context, depending on the affected system's configuration.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-68375. If immediate patching is not possible, disable the bnxt_en driver if not in use or restrict network interfaces using this driver until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart