CVE-2026-74706 Overview
CVE-2026-74706 is a NULL pointer dereference vulnerability in the Linux kernel's bnge network driver. The flaw resides in the auxiliary device release path, specifically inside the bnge_aux_dev_release() callback. When allocation of auxr_dev fails during auxiliary device setup, the kernel's error path invokes auxiliary_device_uninit(), which in turn calls the release callback. That callback unconditionally dereferences aux_priv->auxr_dev->pdev to retrieve the parent bnge_dev, triggering a NULL pointer exception because auxr_dev was never allocated. The upstream fix retrieves the parent bnge_dev from the auxiliary device's parent and only frees auxr_dev when it was successfully allocated.
Critical Impact
A failed auxiliary device allocation in the bnge driver causes the kernel to dereference a NULL pointer, resulting in a kernel oops and denial of service on the affected host.
Affected Products
- Linux kernel builds that include the bnge (Broadcom Next Generation) network driver
- Kernel trees referenced by commits 1cb4298810e27e037d3ca07286ecbb97e89ba58d and 83ef2f3cab7fe6dd9155cd598dc64be524d963a9
- Systems using Broadcom auxiliary bus devices bound to the bnge driver
Discovery Timeline
- 2026-08-22 - CVE-2026-74706 published to NVD
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74706
Vulnerability Analysis
The vulnerability is a NULL pointer dereference [CWE-476] in the Linux kernel bnge driver auxiliary device teardown flow. During auxiliary device initialization, the driver allocates an auxr_dev structure. If this allocation fails, the driver's error path calls auxiliary_device_uninit() to unwind the partially initialized state. That routine ultimately invokes the release callback bnge_aux_dev_release().
The release callback assumes aux_priv->auxr_dev is a valid pointer and dereferences aux_priv->auxr_dev->pdev to reach the parent bnge_dev. On the allocation-failure path this pointer is NULL, so the dereference faults inside kernel context. The result is a kernel oops and loss of driver state on the affected host.
Root Cause
The root cause is a missing precondition check in bnge_aux_dev_release(). The callback retrieves the parent device through auxr_dev without verifying that the pointer was set. The corrected code path obtains the parent bnge_dev from the auxiliary device's own parent field, which is always valid when the release callback runs, and it frees auxr_dev only when a prior allocation succeeded.
Attack Vector
Triggering the flaw requires that auxr_dev allocation fail during bnge auxiliary device setup. This is a local kernel condition, typically observed under memory pressure or during driver load and unload cycles. There is no evidence of a remote attack vector, no public exploit, and the issue is not listed on the CISA KEV catalog. The EPSS score is 0.156%, consistent with a low-likelihood exploitation profile. Impact is limited to denial of service on the local host.
No verified proof-of-concept code is available. See the upstream kernel commits for the precise diff: Kernel Git Commit Fix and Kernel Git Commit Update.
Detection Methods for CVE-2026-74706
Indicators of Compromise
- Kernel oops or panic messages referencing bnge_aux_dev_release in the call trace
- dmesg entries showing NULL pointer dereference during Broadcom auxiliary device probe or teardown
- Repeated driver load failures for the bnge module accompanied by memory allocation warnings
Detection Strategies
- Monitor kernel ring buffer and /var/log/kern.log for stack traces containing bnge_aux_dev_release or auxiliary_device_uninit following an allocation failure
- Correlate bnge module load events with subsequent oops entries to identify systems exercising the vulnerable error path
- Compare running kernel versions against the fixed commits 1cb4298810e27e037d3ca07286ecbb97e89ba58d and 83ef2f3cab7fe6dd9155cd598dc64be524d963a9
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on NULL pointer dereference patterns tied to network driver symbols
- Track memory pressure metrics on hosts running Broadcom NICs, since allocation failures are the precondition for this fault
- Include kernel version and loaded module inventories in host telemetry to identify unpatched systems
How to Mitigate CVE-2026-74706
Immediate Actions Required
- Apply the upstream fix from commit 83ef2f3cab7fe6dd9155cd598dc64be524d963a9 or update to a stable kernel that includes the backport
- Inventory Linux hosts using the bnge driver and prioritize patching those under memory pressure or with frequent driver reloads
- Restrict privileged operations that trigger driver load and unload cycles until patched kernels are deployed
Patch Information
The fix modifies bnge_aux_dev_release() to retrieve the parent bnge_dev from the auxiliary device's parent rather than from aux_priv->auxr_dev->pdev, and frees auxr_dev only when it was successfully allocated. Reference the upstream commits at Kernel Git Commit Fix and Kernel Git Commit Update. Distribution vendors typically deliver the fix through standard stable kernel updates.
Workarounds
- Unload the bnge driver on hosts where the NIC is not in use to eliminate the vulnerable code path
- Reduce memory pressure on affected hosts to lower the probability of auxr_dev allocation failure
- Avoid repeated driver reload cycles in scripts or automation until the fixed kernel is installed
# Confirm running kernel and check for the bnge module
uname -r
lsmod | grep bnge
# Temporarily unload the driver on systems that do not require it
sudo modprobe -r bnge
# Inspect kernel log for prior NULL pointer dereferences in the release path
sudo dmesg | grep -iE 'bnge_aux_dev_release|NULL pointer'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
