CVE-2026-74706

A flaw was found in the Linux kernel's bnge driver. During the setup of an auxiliary device, if the allocation of a specific resource (auxr_dev) fails, the subsequent release process attempts to access an unallocated memory region. This results in a NULL pointer dereference, which can lead to a system crash, causing a Denial of Service (DoS).

This vulnerability is rated with a Moderate severity because exploitation requires local access and specific device initialization failure conditions, restricting the potential blast radius to a denial of service without compromising system confidentiality or integrity. The flaw occurs during auxiliary device teardown within the Broadcom Ethernet driver when an internal allocation fails. Supported Red Hat Enterprise Linux releases are not affected by this vulnerability, as the problematic driver code was introduced in upstream kernel versions that are not present in our shipping kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.