CVE-2026-74706 bnge: Fix NULL pointer dereference in aux device release
A NULL pointer dereference in the bnge driver's error handling path can cause a kernel crash, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74706?
CVE-2026-74706 is a vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bnge: Fix NULL pointer dereference in aux device release
If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release().
The release callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception
Retrieve the parent bnge_dev from the auxiliary device's parent instead of auxr_dev, and free auxr_dev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices.
Which versions are affected by CVE-2026-74706?
How do I fix CVE-2026-74706?
Apply the vendor's patch.
Is CVE-2026-74706 being exploited?
There is no known exploitation of CVE-2026-74706 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-74706, GHSA-fq8p-jp7x-rvrf, UBUNTU-CVE-2026-74706.