What’s Vulnerable › Vulnerabilities

CVE-2026-31621: bnge: return after auxiliary_device_uninit() in error path

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-06-17
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: bnge: return after auxiliary_device_uninit() in error path When auxiliary_device_add() fails, the error block calls auxiliary_device_uninit() but does not return. The uninit drops the last reference and synchronously runs bnge_aux_dev_release(), which sets bd->auxr_dev = NULL and frees the underlying object. The subsequent bd->auxr_dev->net = bd->netdev then dereferences NULL, which is not a good thing to have happen when trying to clean up from an error. Add the missing return, as the auxiliary bus documentation states is a requirement (seems that LLM tools read documentation better than humans do...)

Affected products

• Linux kernel: from 6.19 before 6.19.14; from 7.0 before 7.0.1 — fixed in 6.19.14, 7.0.1

How to fix

Upgrade to a fixed version: Linux kernel 6.19.14, 7.0.1. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a
• https://git.kernel.org/stable/c/87bc3557c708110d83086bf091328271298a44e3
• https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce

Get alerted when CVE-2026-31621 or the next vulnerability affects your stack