CVE-2026-74734

In the Linux kernel, the following vulnerability has been resolved:

firewire: ohci: fix NULL pointer dereference in arcontextrelease

During the error handling path of the driver's probe function, a NULL pointer dereference can occur in arcontextrelease().

When pciprobe() fails early (e.g., if pcimenabledevice() or MMIO mapping fails), the devres cleanup mechanism invokes releaseohci(). This function unconditionally calls arcontextrelease() to clean up the asynchronous receive contexts. However, if arcontextinit() was not yet called, ctx->ohci remains NULL (as the fwohci structure is zero-initialized by devresalloc()).

arcontextrelease() immediately dereferences ctx->ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:arcontextrelease+0x3f/0x380 drivers/firewire/ohci.c:543 Call Trace: releaseohci+0x3f/0x60 drivers/firewire/ohci.c:3567 releasenodes drivers/base/devres.c:546 [inline] devresreleaseall+0x1a8/0x260 drivers/base/devres.c:576 deviceunbindcleanup drivers/base/dd.c:597 [inline] really_probe+0x451/0xae0 drivers/base/dd.c:772

To fix this, move the assignment of the dev pointer after the !ctx->buffer check. If ctx->buffer is NULL, it indicates that the context was never successfully initialized and there is nothing to release, safely avoiding the dereference of the uninitialized ctx->ohci pointer.