From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2C6F3D3CFD for ; Mon, 10 Aug 2026 12:12:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363961; cv=none; b=O1DKOgVlh2JlGABW0yXU/CwLBA3/OrRh+Psxx9bX2nZFNVqsNzGW3IYbgeWcFPgwcTciiEWUHoT7y2EpYgQ3r8du8tO/4GwnRNNtFYgGdOwFIDaRjWVCJX8QaiKMxjM6pqJ+VYkYz+4KqxTbHorCLBpE1Bvrldcksf/d6FoiHpI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786363961; c=relaxed/simple; bh=xUZaqDTojZjA7mQ+4Xg3JqR2DLk2kUMQSRt6tnIpVVs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dYacXe46uin6muJi3rHX3Xwj4bj9RMhXivUP07EE6OC6hclfkvPqBdw/HKzz9GgrB4ou3z95EKJGkNRKTzTm4A/CBS4kRsSlw8N48YZ+W6lfhQpaeRtE6cWyzt7AeJtsh0iMiYfx2KZEJYNOadj/NW8CxW7ziXf4LhkZM1P8Gc0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2Zesd+oE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2Zesd+oE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B69A1F000E9; Mon, 10 Aug 2026 12:12:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786363959; bh=2lv1FAfA+ejg3dFmKfi9V/wEPG7/uyW17HQpCEI1Kz8=; h=From:To:Cc:Subject:Date:Reply-To; b=2Zesd+oEV20W/1hHKpDMuH8+qFGxPtdDQuEZHra8Wg6UMrP/M9Xor2nXXic6AJpUT aYtN0HYHuP3JYfiVU0f7H34KKQqWS37zfINlEOm4VIfw34mvq1Yw2jlBkYvs03tkXx rd6Wkjh9BxSWJ+Lq8ytBSiEtJzYEFn17q1U5BOjA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices Date: Mon, 10 Aug 2026 14:01:32 +0200 Message-ID: <2026081043-CVE-2026-68375-b2c6@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2722; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=RAxckAZGL+xLaI9qiFELNYzdroTsbJ2DXGRjRf5Ejbw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmVe7Z/cvi+Zd/Kd90LQn4ahM8/O1FLutRMazf3sxt3F C6s0b3J2BHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATufmPYcEeHqWuBZXcL/U+ Nay9fD05durEK2UM8zP90nNSlwjlXm6w+OgbvWlChpXyWQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle partially initialized auxiliary devices bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback. The release callback assumes that aux_priv->id, aux_priv->edev, edev->net and edev->ulp_tbl are all populated. If allocation fails after auxiliary_device_init(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxt_en_dev and ULP table before calling auxiliary_device_init(), so the release callback only sees a fully initialized auxiliary private object. If auxiliary_device_init() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review. The Linux kernel CVE team has assigned CVE-2026-68375 to this issue. Affected and fixed versions =========================== Issue introduced in 6.10 with commit 194fad5b27815ca80e832ac875c0026ff96fc243 and fixed in 7.1.6 with commit 4e1caa5fdd0dea36938fe39cceb1522e9d86c937 Issue introduced in 6.10 with commit 194fad5b27815ca80e832ac875c0026ff96fc243 and fixed in 7.2-rc4 with commit 1cb8553c02e93e5a150cebd42f9ee3db0ece4707 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-68375 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4e1caa5fdd0dea36938fe39cceb1522e9d86c937 https://git.kernel.org/stable/c/1cb8553c02e93e5a150cebd42f9ee3db0ece4707