CVE-2026-68375

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Handle partially initialized auxiliary devices

bnxt_aux_devices_init() calls auxiliary_device_init() before all fields

used by bnxt_aux_dev_release() are initialized. After

auxiliary_device_init() succeeds, later errors must unwind with

auxiliary_device_uninit(), which invokes the release callback.

The release callback assumes that aux_priv->id, aux_priv->edev,

edev->net and edev->ulp_tbl are all populated. If allocation fails

after auxiliary_device_init(), the release path can otherwise dereference

or clear partially initialized state.

Allocate and attach the bnxt_en_dev and ULP table before calling

auxiliary_device_init(), so the release callback only sees a fully

initialized auxiliary private object. If auxiliary_device_init() itself

fails, free those allocations directly because device_initialize() has not

run and the release callback will not be invoked.

This issue was found by a static analysis c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References