CVE-2026-89582

A flaw was found in the bnx2x component of the Linux kernel. This flaw occurs due to a double free vulnerability within the bnx2x_init_firmware() function's error handling path. Memory pointers are freed without being set to NULL, allowing the bnx2x_release_firmware() cleanup function to attempt freeing the same memory a second time. This issue could lead to system instability, a denial of service (DoS), or potentially arbitrary code execution.

A double-free in bnx2x_init_firmware() can occur on the firmware initialization error path because bp init_ops_offsets, bp init_ops, and bp init_data are freed without being cleared. If bnx2x_release_firmware() later runs from device removal or the driver state machine, the same allocations can be freed again, creating a kernel memory corruption condition. For the CVSS the PR:L is used in the paranoid score because a reduced capability service account or delegated device management path could potentially influence driver reprobe or failure handling, although the common real world trigger needs administrator control. The issue is local and not network reachable because it occurs during driver initialization or cleanup rather than packet processing. Impact is at least denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact due to a double-free memory corruption primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.