Executive brief
The bnge network driver in the Linux kernel can crash with a NULL pointer exception during error handling when auxiliary device setup fails. This can lead to kernel panics and system unavailability on affected systems, particularly on platforms using Broadcom network adapters with RoCE support.
Technical details
The vulnerability is a NULL pointer dereference in the bnge_aux_dev_release() callback function. If allocation of auxr_dev fails during auxiliary device initialization, the error path calls auxiliary_device_uninit(), which invokes the release callback. The callback unconditionally dereferences aux_priv->auxr_dev->pdev without checking if auxr_dev was successfully allocated, resulting in a NULL pointer exception. The fix retrieves the parent bnge_dev from the auxiliary device's parent pointer instead and adds a NULL check before freeing auxr_dev. This occurs in error handling paths and requires no user interaction; a local attacker or administrator triggering device setup failures could induce a denial of service.
Affected products
- Linux Linux Kernel Multiple versions (patched in linux-6.1.y, linux-6.10.y and others as of 2026-08-19)
Timeline
- 2026-08-22: disclosed
- 2026-08-03: patched: Upstream commit 1cb4298810e27e037d3ca07286ecbb97e89ba58d merged by Jakub Kicinski