CVE-2026-68375

A flaw was found in the Linux kernel's bnxt_en driver, which handles Broadcom NetXtreme-C/E network adapters. The bnxt_aux_devices_init() function calls auxiliary_device_init() before all required fields for the release callback are fully initialized. If a memory allocation fails after auxiliary_device_init() succeeds, the release callback may attempt to access or clear partially initialized data. This could lead to system instability or a denial of service.

This issue affects Broadcom bnxt_en network adapters with auxiliary devices. auxiliary_device_init() may succeed before all fields used by release are initialized, causing issues on partial init failure unwind. Systems without bnxt_en hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the bnxt_en module from loading. See https://access.redhat.com/solutions/41278 for instructions.