Linux Kernel Vulnerability in bnge Auxiliary Device

CVE-2026-74706

What is CVE-2026-74706?

In the Linux kernel, a vulnerability related to memory management in the bnge driver has been identified. When the allocation of the auxiliary device (auxr_dev) fails during the setup process, the system incorrectly tries to dereference a pointer to the parent bnge_dev. This situation arises because the error handling fails to manage the unallocated auxr_dev properly, leading to a NULL pointer exception. The vulnerability has been addressed by ensuring that the parent bnge_dev is retrieved from the auxiliary device's parent instead of from an uninitialized structure. The proper handling allows for a safe cleanup process of auxiliary devices, preventing system crashes during error scenarios.

References