CVE-2026-74734 Overview
CVE-2026-74734 is a NULL pointer dereference vulnerability in the Linux kernel's FireWire OHCI driver, specifically in the ar_context_release() function located in drivers/firewire/ohci.c. The flaw occurs during the error handling path of the driver's pci_probe() function. When early probe failures trigger devres cleanup, release_ohci() unconditionally invokes ar_context_release(), which dereferences an uninitialized ctx->ohci pointer. This results in a kernel oops with a general protection fault detected by KASAN.
Critical Impact
A local unprivileged trigger of an early FireWire OHCI probe failure can cause a kernel NULL pointer dereference, producing a denial-of-service through kernel crash.
Affected Products
- Linux kernel builds with the firewire-ohci driver (CONFIG_FIREWIRE_OHCI) enabled
- Systems exposing IEEE 1394 OHCI controllers via PCI
- Stable kernel branches referenced by commits 42d217a, 7d228ba, and ed54707
Discovery Timeline
- 2026-08-26 - CVE-2026-74734 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74734
Vulnerability Analysis
The defect is a classic NULL pointer dereference [CWE-476] triggered by an ordering bug in cleanup code. The fw_ohci structure is zero-initialized by devres_alloc(). If pci_probe() fails before ar_context_init() runs, the ctx->ohci field remains NULL. The devres framework still runs release_ohci(), which calls ar_context_release() for each asynchronous receive context. ar_context_release() dereferences ctx->ohci to obtain the dev pointer before it validates whether the context was ever initialized.
KASAN reports the fault as a null-ptr-deref in the range [0x0000000000000008-0x000000000000000f], with the faulting instruction at ar_context_release+0x3f/0x380 in drivers/firewire/ohci.c:543. The call chain traverses release_ohci → release_nodes → devres_release_all → device_unbind_cleanup → really_probe.
Root Cause
The root cause is unordered cleanup logic. ar_context_release() uses ctx->ohci before checking ctx->buffer, which is the sentinel that indicates whether ar_context_init() completed. Because devres registers the release callback prior to full initialization, any early probe failure such as pcim_enable_device() or MMIO mapping failure invokes the release on a zero-initialized context.
Attack Vector
The crash requires triggering an early failure inside pci_probe() of the firewire-ohci driver. Realistic triggers include hardware misconfiguration, module load against a partially functional OHCI controller, or fault injection during PCI device enablement. The impact is a kernel denial of service on affected hosts. There is no indication of memory corruption or privilege escalation.
The fix moves the assignment of the dev pointer to after the !ctx->buffer check. When ctx->buffer is NULL, the function returns early and never dereferences the uninitialized ctx->ohci pointer. See the upstream commits Kernel Git Commit 42d217a, Kernel Git Commit 7d228ba, and Kernel Git Commit ed54707 for the patch content.
Detection Methods for CVE-2026-74734
Indicators of Compromise
- Kernel oops messages referencing ar_context_release+0x3f/0x380 in drivers/firewire/ohci.c
- KASAN reports of null-ptr-deref originating from release_ohci during driver probe
- Unexpected firewire-ohci module load failures followed by a kernel panic or general protection fault
Detection Strategies
- Parse dmesg and journalctl -k for general protection fault entries with call traces containing release_ohci and ar_context_release
- Correlate PCI probe failure messages for FireWire OHCI controllers with subsequent kernel crash dumps in /var/crash
- Track kernel package versions across the fleet and flag hosts running kernels prior to the patched stable releases
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and alert on firewire_ohci probe failures paired with oops signatures
- Monitor unexpected reboots or kernel panic telemetry on servers and workstations that expose IEEE 1394 controllers
- Include firewire-ohci module state in configuration compliance checks so unnecessary loads on hardened systems are flagged
How to Mitigate CVE-2026-74734
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 42d217a, 7d228ba, and ed54707
- Reboot hosts after installing the patched kernel so the fixed firewire-ohci module is loaded
- If patching is not immediately possible, blacklist the firewire-ohci module on systems that do not require IEEE 1394 support
Patch Information
The fix is contained in three Linux stable tree commits: Kernel Git Commit 42d217a, Kernel Git Commit 7d228ba, and Kernel Git Commit ed54707. The patch reorders operations in ar_context_release() so the !ctx->buffer guard executes before any dereference of ctx->ohci. Distribution vendors will ship the fix in updated kernel packages tracking the affected stable branches.
Workarounds
- Prevent the vulnerable driver from loading by adding blacklist firewire-ohci to /etc/modprobe.d/ on systems that do not use IEEE 1394 devices
- Physically disable FireWire controllers in system firmware where hardware settings permit
- Restrict local access to hosts with FireWire hardware until the patched kernel is deployed
# Configuration example: disable the firewire-ohci module on affected hosts
echo 'blacklist firewire-ohci' | sudo tee /etc/modprobe.d/disable-firewire-ohci.conf
sudo depmod -a
sudo update-initramfs -u
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
