CVE-2026-31621

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31621
In the Linux kernel, the following vulnerability has been resolved: bnge: return after auxiliary_device_uninit() in error path When auxiliary_device_add() fails, the error block calls auxiliary_device_uninit() but does not return. The uninit drops the last reference and synchronously runs bnge_aux_dev_release(), which sets bd->auxr_dev = NULL and frees the underlying object. The subsequent bd->auxr_dev->net = bd->netdev then dereferences NULL, which is not a good thing to have happen when trying to clean up from an error. Add the missing return, as the auxiliary bus documentation states is a requirement (seems that LLM tools read documentation better than humans do...)

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a Patch
https://git.kernel.org/stable/c/87bc3557c708110d83086bf091328271298a44e3 Patch
https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

28 Apr 2026, 14:05

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CWE CWE-908
References () https://git.kernel.org/stable/c/38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a - () https://git.kernel.org/stable/c/38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a - Patch
References () https://git.kernel.org/stable/c/87bc3557c708110d83086bf091328271298a44e3 - () https://git.kernel.org/stable/c/87bc3557c708110d83086bf091328271298a44e3 - Patch
References () https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce - () https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

27 Apr 2026, 12:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce -

24 Apr 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-24 15:16

Updated : 2026-04-28 14:05

NVD link : CVE-2026-31621

Mitre link : CVE-2026-31621

CVE.ORG link : CVE-2026-31621

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource