CVE-2026-89582: Linux Kernel bnx2x Use-After-Free Vulnerability

CVE-2026-89582 Overview

CVE-2026-89582 is a double free vulnerability in the Linux kernel's bnx2x Broadcom NetXtreme II 10Gb Ethernet driver. The flaw exists in bnx2x_init_firmware(), which frees bp->init_ops, bp->init_data, and bp->init_ops_offsets in its error path without setting the pointers to NULL. When bnx2x_release_firmware() runs later, it unconditionally frees the same three pointers, triggering a second free of already-released memory. The cleanup can be reached through __bnx2x_remove or the driver's function state machine. Kernel maintainers resolved the issue by nulling each pointer after kfree() in the error path.

Critical Impact
A double free in kernel heap memory can lead to memory corruption, kernel panics, or potential local privilege escalation on systems using the Broadcom bnx2x network driver.

Affected Products

Linux kernel versions containing the vulnerable bnx2x_init_firmware() implementation
Systems using Broadcom NetXtreme II 10Gb Ethernet adapters with the bnx2x driver
Distributions shipping the affected kernel prior to the applied stable patches

Discovery Timeline

2026-09-11 - CVE-2026-89582 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89582

Vulnerability Analysis

The vulnerability resides in the bnx2x driver's firmware initialization logic. bnx2x_init_firmware() allocates three buffers referenced by bp->init_ops, bp->init_data, and bp->init_ops_offsets. On failure, the function calls kfree() on each pointer but leaves the dangling references intact in the bnx2x private structure.

The cleanup routine bnx2x_release_firmware() frees the same three pointers unconditionally. When bnx2x_init_firmware() fails and cleanup subsequently runs through __bnx2x_remove or the driver's function state machine, each pointer is passed to kfree() twice. This produces a classic double free [CWE-415] on kernel slab allocations.

Root Cause

The root cause is missing pointer invalidation after kfree() in the error path of bnx2x_init_firmware(). Without setting the freed pointers to NULL, the driver relies on caller state that is inconsistent with the actual allocation status. The fix nulls each pointer after release so that the subsequent kfree(NULL) in bnx2x_release_firmware() becomes a safe no-op.

Attack Vector

Triggering the flaw requires the kernel to enter the bnx2x_init_firmware() error path followed by execution of bnx2x_release_firmware(). This condition can occur during driver initialization failures, device removal, or transitions in the function state machine. Successful exploitation of a double free in the SLUB allocator can corrupt kernel heap metadata, cause denial of service through kernel panic, or in some scenarios enable privilege escalation. Exploitation requires local access to a system with the affected driver loaded.

See the upstream fixes for implementation detail, including the primary stable commit and additional backported patches.

Detection Methods for CVE-2026-89582

Indicators of Compromise

Kernel oops or panic messages referencing bnx2x_release_firmware or bnx2x_init_firmware in dmesg or /var/log/kern.log
SLUB allocator warnings such as double free or corruption tied to bnx2x module context
Unexpected reset or removal cycles of Broadcom NetXtreme II 10Gb Ethernet interfaces

Detection Strategies

Audit loaded kernel modules for bnx2x on hosts running unpatched kernel versions and cross-reference against fixed commit hashes
Enable KASAN (Kernel Address Sanitizer) in test environments to detect use-after-free and double free conditions in driver code paths
Monitor for repeated firmware load failures immediately followed by device removal events in kernel logs

Monitoring Recommendations

Forward kernel and syslog telemetry to a centralized analytics platform for correlation of driver crash signatures across the fleet
Alert on kernel panics or module-specific stack traces containing bnx2x symbols
Track kernel package versions across Linux hosts and flag systems missing the stable backport containing the fix

How to Mitigate CVE-2026-89582

Immediate Actions Required

Apply the stable kernel updates that include the upstream fix nulling the three pointers after kfree() in bnx2x_init_firmware()
Inventory all Linux systems using Broadcom NetXtreme II 10Gb adapters and prioritize patching those hosts
Restrict local access on unpatched systems until vendor kernel packages are deployed

Patch Information

The fix is available across multiple stable branches. Reference the upstream commits including dc98e727b9cf, 07d4516e3eb1, 4d36e38e4834, 770715784b68, a142c024f07d, ac280f6872e7, c44e5d6c3189, and d2796ffe38cb. Consume the fix through your distribution's kernel updates.

Workarounds

Blacklist the bnx2x module on systems that do not require Broadcom NetXtreme II 10Gb networking until a patched kernel is installed
Avoid manual driver unload and reload cycles on unpatched hosts to reduce the likelihood of hitting the error path
Ensure firmware files required by bnx2x are present and valid to minimize bnx2x_init_firmware() failures

bash

# Verify running kernel version and check bnx2x module status
uname -r
lsmod | grep bnx2x

# Temporarily blacklist bnx2x until patched kernel is deployed
echo "blacklist bnx2x" | sudo tee /etc/modprobe.d/blacklist-bnx2x.conf
sudo update-initramfs -u