Executive brief
The Linux kernel's FireWire OHCI driver contains a NULL pointer dereference flaw in error handling. When the driver fails to initialize during system startup (for example, if hardware access fails), a cleanup routine crashes while trying to access an uninitialized device pointer, potentially causing a kernel panic or system instability.
Technical details
The vulnerability is a NULL pointer dereference in the ar_context_release() function within the FireWire OHCI driver (drivers/firewire/ohci.c). During device probe failure (e.g., when pcim_enable_device() or MMIO mapping fails), the devres cleanup mechanism calls release_ohci(), which unconditionally invokes ar_context_release(). However, if ar_context_init() was never called, the ctx->ohci pointer remains NULL. The function immediately dereferences ctx->ohci before checking if the context was initialized (via ctx->buffer), causing a general protection fault. The fix moves the dev pointer assignment after the !ctx->buffer check, ensuring the uninitialized pointer is not dereferenced. The attack vector is local (triggered during driver initialization on affected hardware) and requires no user interaction—only a system with FireWire OHCI hardware and a failing probe condition.
Affected products
- Linux Linux Kernel affected versions prior to the fix (exact range not specified in advisory)
Timeline
- 2026-08-26: disclosed