CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Handle partially initialized auxiliary devices

bnxtauxdevicesinit() calls auxiliarydeviceinit() before all fields used by bnxtauxdevrelease() are initialized. After auxiliarydeviceinit() succeeds, later errors must unwind with auxiliarydeviceuninit(), which invokes the release callback.

The release callback assumes that auxpriv->id, auxpriv->edev, edev->net and edev->ulptbl are all populated. If allocation fails after auxiliarydevice_init(), the release path can otherwise dereference or clear partially initialized state.

Allocate and attach the bnxtendev and ULP table before calling auxiliarydeviceinit(), so the release callback only sees a fully initialized auxiliary private object. If auxiliarydeviceinit() itself fails, free those allocations directly because device_initialize() has not run and the release callback will not be invoked.

This issue was found by a static analysis checker and confirmed by manual source review.