Linux Kernel up to 7.1.5/7.2-rc3 bnxt_en bnxt_aux_devices_init null pointer dereference

Summaryinfo

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.1.5/7.2-rc3. This affects the function bnxt_aux_devices_init of the component bnxt_en. Performing a manipulation results in null pointer dereference. This vulnerability is identified as CVE-2026-68375. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.5/7.2-rc3. This affects the function bnxt_aux_devices_init of the component bnxt_en. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle partially initialized auxiliary devices bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback. The release callback assumes that aux_priv->id, aux_priv->edev, edev->net and edev->ulp_tbl are all populated. If allocation fails after auxiliary_device_init(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxt_en_dev and ULP table before calling auxiliary_device_init(), so the release callback only sees a fully initialized auxiliary private object. If auxiliary_device_init() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-68375 since 07/30/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/10/2026).

Upgrading to version 7.1.6 or 7.2-rc4 eliminates this vulnerability. Applying the patch 4e1caa5fdd0dea36938fe39cceb1522e9d86c937/1cb8553c02e93e5a150cebd42f9ee3db0ece4707 is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion