CVE-2026-68375 Overview
CVE-2026-68375 is a Linux kernel vulnerability in the bnxt_en Broadcom NetXtreme Ethernet driver. The flaw affects the auxiliary device initialization path in bnxt_aux_devices_init(). The function calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are populated. If subsequent allocation fails, the release callback can dereference or clear partially initialized state. Kernel maintainers identified the issue through static analysis and confirmed it with manual source review. The fix reorders allocation so that bnxt_en_dev and the ULP table are attached before auxiliary_device_init() runs.
Critical Impact
Improper error unwinding in the bnxt_en auxiliary device path can dereference partially initialized memory, leading to kernel instability or potential memory corruption on systems using Broadcom NetXtreme adapters.
Affected Products
- Linux kernel bnxt_en driver (Broadcom NetXtreme Ethernet)
- Stable kernel branches receiving commits 1cb8553c02e9 and 4e1caa5fdd0d
- Systems using Broadcom NIC hardware with auxiliary bus RDMA/ULP registration
Discovery Timeline
- 2026-08-10 - CVE-2026-68375 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68375
Vulnerability Analysis
The vulnerability resides in bnxt_aux_devices_init() within the bnxt_en driver. The function registers an auxiliary device using the Linux kernel auxiliary bus. Kernel auxiliary bus semantics require that after auxiliary_device_init() succeeds, any subsequent error must unwind through auxiliary_device_uninit(), which invokes the driver's release callback.
The bnxt_aux_dev_release() callback assumes aux_priv->id, aux_priv->edev, edev->net, and edev->ulp_tbl are all populated. The original code performed allocations for these structures after auxiliary_device_init() had already run. If any of those allocations failed, the driver invoked the standard unwind path. The release callback then operated on a partially constructed object, dereferencing NULL or uninitialized pointers.
The fix moves bnxt_en_dev and ULP table allocation ahead of auxiliary_device_init(). When auxiliary_device_init() itself fails, the driver frees allocations directly because device_initialize() has not run and the release callback will not fire.
Root Cause
The root cause is an ordering defect in resource acquisition versus device initialization. Fields required by the release callback were populated after the point at which the release callback becomes reachable through the unwind path. This creates a window where error handling touches uninitialized state.
Attack Vector
The defect triggers only during driver probe or auxiliary device registration under allocation failure conditions. It is not a remotely reachable code path. The failure requires kernel memory pressure or a probe-time error on a system with a Broadcom NetXtreme adapter. Exploitation potential is limited to local denial of service or kernel state corruption during device initialization. See the kernel commit and follow-up commit for the full patch.
Detection Methods for CVE-2026-68375
Indicators of Compromise
- Kernel oops or NULL pointer dereference messages referencing bnxt_aux_dev_release or bnxt_aux_devices_init in dmesg
- Failed probe events for bnxt_en auxiliary devices under memory pressure
- Unexpected reboots or driver load failures on hosts with Broadcom NetXtreme NICs
Detection Strategies
- Inventory kernel versions across Linux hosts and cross-reference against patched stable branches containing commits 1cb8553c02e9 and 4e1caa5fdd0d
- Monitor kernel logs for auxiliary bus release callback stack traces involving bnxt symbols
- Track NIC driver crash reports through host telemetry pipelines
Monitoring Recommendations
- Collect dmesg and /var/log/kern.log centrally for pattern matching on bnxt_en errors
- Alert on repeated driver probe failures on servers with Broadcom hardware
- Establish baselines for kernel panic frequency and investigate deviations tied to network driver load events
How to Mitigate CVE-2026-68375
Immediate Actions Required
- Identify all Linux hosts running affected bnxt_en driver versions, particularly hosts with Broadcom NetXtreme adapters
- Apply the upstream stable kernel update containing commits 1cb8553c02e9 and 4e1caa5fdd0d
- Reboot affected systems to load the patched kernel
Patch Information
The fix is available in the Linux stable tree. Reference the primary commit and the companion commit. Distribution vendors will ship the fix through routine kernel security updates. Apply distribution updates through the normal package management workflow.
Workarounds
- No configuration-level workaround exists; the defect is in driver initialization code
- On non-critical systems, unloading the bnxt_en module avoids the code path but disables the network interface
- Reduce probability of allocation failure at probe time by ensuring adequate memory headroom on affected hosts
# Verify running kernel version and installed patch level
uname -r
grep -r bnxt_en /var/log/dmesg
# Apply distribution kernel update
sudo apt update && sudo apt upgrade linux-image-$(uname -r)
# Reboot to activate patched kernel
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
