CVE-2026-74734
Received Received - Intake

NULL Pointer Dereference in Linux Kernel FireWire OHCI Driver

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in ar_context_release During the error handling path of the driver's probe function, a NULL pointer dereference can occur in ar_context_release(). When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping fails), the devres cleanup mechanism invokes release_ohci(). This function unconditionally calls ar_context_release() to clean up the asynchronous receive contexts. However, if ar_context_init() was not yet called, ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by devres_alloc()). ar_context_release() immediately dereferences ctx->ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543 Call Trace: release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567 release_nodes drivers/base/devres.c:546 [inline] devres_release_all+0x1a8/0x260 drivers/base/devres.c:576 device_unbind_cleanup drivers/base/dd.c:597 [inline] really_probe+0x451/0xae0 drivers/base/dd.c:772 To fix this, move the assignment of the dev pointer after the !ctx->buffer check. If ctx->buffer is NULL, it indicates that the context was never successfully initialized and there is nothing to release, safely avoiding the dereference of the uninitialized ctx->ohci pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74734
EUVD
EUVD-2026-66564

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's firewire ohci driver. It occurs during error handling in the probe function when pci_probe() fails early. The ar_context_release() function tries to access a NULL pointer (ctx->ohci) before checking if the context was initialized, causing a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's firewire ohci driver and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors in firewire or ohci modules using: dmesg | grep -i "firewire\|ohci\|general protection fault"

Impact Analysis

This vulnerability can cause system crashes (kernel panic) when the firewire ohci driver fails to initialize properly. It may lead to denial of service conditions where the affected system becomes unresponsive or requires a reboot.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If using a vulnerable kernel, avoid loading the firewire ohci driver by blacklisting it with: echo "blacklist firewire_ohci" | sudo tee /etc/modprobe.d/blacklist-firewire.conf && sudo update-initramfs -u

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74734. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart