CVE-2026-74706
Received Received - Intake

NULL Pointer Dereference in Linux Kernel BNGE Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception Retrieve the parent bnge_dev from the auxiliary device's parent instead of auxr_dev, and free auxr_dev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74706
EUVD
EUVD-2026-64393

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel. It occurs during auxiliary device setup when memory allocation for auxr_dev fails. The error path incorrectly tries to access aux_priv->auxr_dev->pdev in the release callback, but auxr_dev was never allocated, causing a crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's bnge driver and involves a NULL pointer dereference during auxiliary device setup. Detection requires checking kernel logs for NULL pointer exceptions related to bnge_aux_dev_release or auxiliary device initialization failures.

Impact Analysis

If exploited, this could cause kernel crashes (denial of service) on systems using the affected Linux kernel component. It may lead to system instability or require a reboot to recover.

Mitigation Strategies

Update your Linux kernel to the latest patched version that resolves this issue. If you cannot update immediately, disable the bnge driver module if not in use to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart