VulnerabilityPublished 10 Aug 2026Updated 21 Oct 2026

CVE-2026-68375: Linux kernel · bnxt_en: Handle partially initialized auxiliary devices

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e75f1a5b267e820f5b7900c16d84f12c122218cc : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e75f1a5b267e820f5b7900c16d84f12c122218cc, 8549ac21ab503fc7a40bfa8e6beb69e6320d9877, 4e1caa5fdd0dea36938fe39cceb1522e9d86c937 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to e75f1a5b267e820f5b7900c16d84f12c122218cc, 8549ac21ab503fc7a40bfa8e6beb69e6320d9877, 4e1caa5fdd0dea36938fe39cceb1522e9d86c937 or 1cb8553c02e93e5a150cebd42f9ee3db0ece4707.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 194fad5b27815ca80e832ac875c0026ff96fc243, < e75f1a5b267e820f5b7900c16d84f12c122218cc	Fixed in e75f1a5b267e820f5b7900c16d84f12c122218cc
LinuxLinux	Affected ≥ 194fad5b27815ca80e832ac875c0026ff96fc243, < 8549ac21ab503fc7a40bfa8e6beb69e6320d9877	Fixed in 8549ac21ab503fc7a40bfa8e6beb69e6320d9877
LinuxLinux	Affected ≥ 194fad5b27815ca80e832ac875c0026ff96fc243, < 4e1caa5fdd0dea36938fe39cceb1522e9d86c937	Fixed in 4e1caa5fdd0dea36938fe39cceb1522e9d86c937
LinuxLinux	Affected ≥ 194fad5b27815ca80e832ac875c0026ff96fc243, < 1cb8553c02e93e5a150cebd42f9ee3db0ece4707	Fixed in 1cb8553c02e93e5a150cebd42f9ee3db0ece4707
LinuxLinux	Affected =6.10	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle partially initialized auxiliary devices bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback. The release callback assumes that aux_priv->id, aux_priv->edev, edev->net and edev->ulp_tbl are all populated. If allocation fails after auxiliary_device_init(), the release path can otherwise dereference or clear partially initialized state. Allocate and attach the bnxt_en_dev and ULP table before calling auxiliary_device_init(), so the release callback only sees a fully initialized auxiliary private object. If auxiliary_device_init() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked. This issue was found by a static analysis checker and confirmed by manual source review.

References

Community reviews

Loading reviews…