CVE-2026-74706
In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxr_dev fails during auxiliary device setup, the error path calls auxiliary_device_uninit(), which eventually invokes bnge_aux_dev_release(). The release callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated on this failure path, the dereference results in a NULL pointer exception Retrieve the parent bnge_dev from the auxiliary device's parent instead of auxr_dev, and free auxr_dev only when it was successfully allocated. This allows the release callback to correctly clean up partially initialized auxiliary devices.
Affected versions
Linux kernel versions
6.19
and later are affected. Fixed in
7.1.9,
7.2
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-74706?
CVE-2026-74706 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.19 onward and has been patched in 7.1.9 and 7.2. CVE-2026-74706 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74706?
Yes. CVE-2026-74706 has been patched. Fixed versions include 7.1.9 and 7.2. If you are running Linux kernel 6.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74706 actively exploited?
No. CVE-2026-74706 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.