CVE-2026-89582

Received Received - Intake

Double Free in Linux Kernel bnx2x Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2x_init_firmware() error path bnx2x_init_firmware() frees bp->init_ops, bp->init_data and bp->init_ops_offsets in its error path without setting them to NULL. The cleanup function bnx2x_release_firmware() frees the same three pointers unconditionally, so if init_firmware fails and release_firmware is later called (e.g. from __bnx2x_remove or through the function state machine), all three are freed a second time. Set each pointer to NULL after kfree() in the error path so that the subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89582

EUVD

EUVD-2026-76494

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a double-free vulnerability in the Linux kernel's bnx2x driver. The bnx2x_init_firmware() function frees three pointers in its error path without setting them to NULL. Later, bnx2x_release_firmware() attempts to free the same pointers unconditionally, causing a second free of already freed memory.

Detection Guidance

This vulnerability affects the Linux kernel's bnx2x driver and involves a double-free issue in the firmware initialization error path. Detection requires checking if your system uses the affected bnx2x driver and kernel version. Commands like 'lsmod | grep bnx2x' can verify if the driver is loaded. Kernel version checks with 'uname -r' may help identify vulnerable versions. However, specific detection commands depend on your distribution and kernel configuration.

Impact Analysis

This could lead to kernel crashes, system instability, or potential privilege escalation if exploited. Systems using affected bnx2x driver versions may experience unexpected behavior or security issues.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories or package repositories for kernel updates. If an update is unavailable, consider disabling the bnx2x driver if not in use. Monitor vendor announcements for firmware or driver patches addressing this double-free issue.

Hi! I’m here to help you understand CVE-2026-89582. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70