CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bnxt_en: Handle partially initialized auxiliary devices<br /> <br /> bnxt_aux_devices_init() calls auxiliary_device_init() before all fields<br /> used by bnxt_aux_dev_release() are initialized. After<br /> auxiliary_device_init() succeeds, later errors must unwind with<br /> auxiliary_device_uninit(), which invokes the release callback.<br /> <br /> The release callback assumes that aux_priv-&gt;id, aux_priv-&gt;edev,<br /> edev-&gt;net and edev-&gt;ulp_tbl are all populated. If allocation fails<br /> after auxiliary_device_init(), the release path can otherwise dereference<br /> or clear partially initialized state.<br /> <br /> Allocate and attach the bnxt_en_dev and ULP table before calling<br /> auxiliary_device_init(), so the release callback only sees a fully<br /> initialized auxiliary private object. If auxiliary_device_init() itself<br /> fails, free those allocations directly because device_initialize() has not<br /> run and the release callback will not be invoked.<br /> <br /> This issue was found by a static analysis checker and confirmed by manual<br /> source review.