{"id":"CVE-2026-74734","title":"firewire: ohci: fix NULL pointer dereference in ar_context_release","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: ohci: fix NULL pointer dereference in ar_context_release\n\nDuring the error handling path of the driver's probe function, a NULL\npointer dereference can occur …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < 3770a4794a14331c8ca6a674e49c021827521c2c","Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < ca2fa74f3200ced6e0a940753ad99844c42ad7c8","Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < ed5470771c7ed7f959230c4697f316af83426a90","Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < 7d228ba43279de2d191f25e139fad166409c2c06","Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < 42d217add8d80d6e7d9f58f80d11ea9b07ea113e","Linux 6.5"],"published":"2026-08-26","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:46:20.638Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74734","references":[{"url":"https://git.kernel.org/stable/c/3770a4794a14331c8ca6a674e49c021827521c2c"},{"url":"https://git.kernel.org/stable/c/ca2fa74f3200ced6e0a940753ad99844c42ad7c8"},{"url":"https://git.kernel.org/stable/c/ed5470771c7ed7f959230c4697f316af83426a90"},{"url":"https://git.kernel.org/stable/c/7d228ba43279de2d191f25e139fad166409c2c06"},{"url":"https://git.kernel.org/stable/c/42d217add8d80d6e7d9f58f80d11ea9b07ea113e"}],"tags":["cve.org"],"epss":0.00206,"epssPercentile":0.10131,"ingestedAt":"2026-10-21T12:48:53.575Z","slug":"CVE-2026-74734","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: ohci: fix NULL pointer dereference in ar_context_release\n\nDuring the error handling path of the driver's probe function, a NULL\npointer dereference can occur in ar_context_release().\n\nWhen pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping\nfails), the devres cleanup mechanism invokes release_ohci(). This function\nunconditionally calls ar_context_release() to clean up the asynchronous\nreceive contexts. However, if ar_context_init() was not yet called,\nctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by\ndevres_alloc()).\n\nar_context_release() immediately dereferences ctx->ohci to get the dev\npointer before checking if the context was actually initialized, leading to\na crash:\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nRIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543\nCall Trace:\n release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567\n release_nodes drivers/base/devres.c:546 [inline]\n devres_release_all+0x1a8/0x260 drivers/base/devres.c:576\n device_unbind_cleanup drivers/base/dd.c:597 [inline]\n really_probe+0x451/0xae0 drivers/base/dd.c:772\n\nTo fix this, move the assignment of the dev pointer after the !ctx->buffer\ncheck. If ctx->buffer is NULL, it indicates that the context was never\nsuccessfully initialized and there is nothing to release, safely avoiding\nthe dereference of the uninitialized ctx->ohci pointer.\n\n## Affected\n\n- `Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < 3770a4794a14331c8ca6a674e49c021827521c2c`\n- `Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < ca2fa74f3200ced6e0a940753ad99844c42ad7c8`\n- `Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < ed5470771c7ed7f959230c4697f316af83426a90`\n- `Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < 7d228ba43279de2d191f25e139fad166409c2c06`\n- `Linux >= 5716e58aecdd4f7225c2e46ce903a839fc54f22f < 42d217add8d80d6e7d9f58f80d11ea9b07ea113e`\n- `Linux 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}