---
id: CVE-2026-68375
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bnxt_en: Handle partially initialized auxiliary devices

  bnxt_aux_devices_init() calls auxiliary_device_init() before all fields
  used by bnxt_aux_dev_release() are init…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bnxt_en: Handle partially initialized auxiliary devices

  bnxt_aux_devices_init() calls auxiliary_device_init() before all fields
  used by bnxt_aux_dev_release() are init…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 194fad5b27815ca80e832ac875c0026ff96fc243 <
    8549ac21ab503fc7a40bfa8e6beb69e6320d9877
  - >-
    Linux >= 194fad5b27815ca80e832ac875c0026ff96fc243 <
    4e1caa5fdd0dea36938fe39cceb1522e9d86c937
  - >-
    Linux >= 194fad5b27815ca80e832ac875c0026ff96fc243 <
    1cb8553c02e93e5a150cebd42f9ee3db0ece4707
  - Linux 6.10
published: '2026-08-10'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:41.230'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68375'
references:
  - url: 'https://git.kernel.org/stable/c/1cb8553c02e93e5a150cebd42f9ee3db0ece4707'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4e1caa5fdd0dea36938fe39cceb1522e9d86c937'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8549ac21ab503fc7a40bfa8e6beb69e6320d9877'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00162
epssPercentile: 0.05075
ingestedAt: '2026-10-15T11:00:41.691Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Handle partially initialized auxiliary devices

bnxt_aux_devices_init() calls auxiliary_device_init() before all fields
used by bnxt_aux_dev_release() are initialized.  After
auxiliary_device_init() succeeds, later errors must unwind with
auxiliary_device_uninit(), which invokes the release callback.

The release callback assumes that aux_priv->id, aux_priv->edev,
edev->net and edev->ulp_tbl are all populated.  If allocation fails
after auxiliary_device_init(), the release path can otherwise dereference
or clear partially initialized state.

Allocate and attach the bnxt_en_dev and ULP table before calling
auxiliary_device_init(), so the release callback only sees a fully
initialized auxiliary private object.  If auxiliary_device_init() itself
fails, free those allocations directly because device_initialize() has not
run and the release callback will not be invoked.

This issue was found by a static analysis checker and confirmed by manual
source review.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.