{"id":"CVE-2026-68375","revision":"14cbbeb9edab4ba9b393797d68bae657","records":[{"revision":"14cbbeb9edab4ba9b393797d68bae657","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68375","aliases":[],"title":"bnxt_en: Handle partially initialized auxiliary devices","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Handle partially initialized auxiliary devices\n\nbnxt_aux_devices_init() calls auxiliary_device_init() before all fields\nused by bnxt_aux_dev_release() are initialized.  After\nauxiliary_device_init() succeeds, later errors must unwind with\nauxiliary_device_uninit(), which invokes the release callback.\n\nThe release callback assumes that aux_priv->id, aux_priv->edev,\nedev->net and edev->ulp_tbl are all populated.  If allocation fails\nafter auxiliary_device_init(), the release path can otherwise dereference\nor clear partially initialized state.\n\nAllocate and attach the bnxt_en_dev and ULP table before calling\nauxiliary_device_init(), so the release callback only sees a fully\ninitialized auxiliary private object.  If auxiliary_device_init() itself\nfails, free those allocations directly because device_initialize() has not\nrun and the release callback will not be invoked.\n\nThis issue was found by a static analysis checker and confirmed by manual\nsource review.","state":0,"publishedAt":"2026-08-10T12:03:53.659+00:00","modifiedAt":"2026-10-21T12:43:53.285+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"194fad5b27815ca80e832ac875c0026ff96fc243\",\n                            \"lessThan\": \"e75f1a5b267e820f5b7900c16d84f12c122218cc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"194fad5b27815ca80e832ac875c0026ff96fc243\",\n                            \"lessThan\": \"8549ac21ab503fc7a40bfa8e6beb69e6320d9877\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"194fad5b27815ca80e832ac875c0026ff96fc243\",\n                            \"lessThan\": \"4e1caa5fdd0dea36938fe39cceb1522e9d86c937\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"194fad5b27815ca80e832ac875c0026ff96fc243\",\n                            \"lessThan\": \"1cb8553c02e93e5a150cebd42f9ee3db0ece4707\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e75f1a5b267e820f5b7900c16d84f12c122218cc","https://git.kernel.org/stable/c/8549ac21ab503fc7a40bfa8e6beb69e6320d9877","https://git.kernel.org/stable/c/4e1caa5fdd0dea36938fe39cceb1522e9d86c937","https://git.kernel.org/stable/c/1cb8553c02e93e5a150cebd42f9ee3db0ece4707"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68375","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68375","identifiers":["CVE-2026-68375"]},"retained":false,"historicalAffected":[]}],"coverage":[]}