CVE-2026-89582

Summary

In the Linux kernel, the following vulnerability has been resolved:

bnx2x: fix double free in bnx2x_init_firmware() error path

bnx2x_init_firmware() frees bp->init_ops, bp->init_data and bp->init_ops_offsets in its error path without setting them to NULL. The cleanup function bnx2x_release_firmware() frees the same three pointers unconditionally, so if init_firmware fails and release_firmware is later called (e.g. from __bnx2x_remove or through the function state machine), all three are freed a second time.

Set each pointer to NULL after kfree() in the error path so that the subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux94a78b79cb5f14c09a42522738d6694c6a1cdd20 < dc98e727b9cfc5e19c796bf893878153f00b222baffected
LinuxLinux94a78b79cb5f14c09a42522738d6694c6a1cdd20 < 4d36e38e48340a1ccf92a98c7a22d07a954e5aa3affected
LinuxLinux94a78b79cb5f14c09a42522738d6694c6a1cdd20 < a142c024f07d623e2b6b25943f6c36d4b6b0b4c6affected
LinuxLinux94a78b79cb5f14c09a42522738d6694c6a1cdd20 < d2796ffe38cb4155afe0eab23636295b096c27a5affected
LinuxLinux2.6.31affected
LinuxLinux0 < 2.6.31unaffected
LinuxLinux6.12.109 <= 6.12.*unaffected
LinuxLinux6.18.50 <= 6.18.*unaffected
LinuxLinux7.2.4 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References