PT-2026-34973 · Linux · Linux Kernel

Published 2026-04-24 · Updated 2026-05-06 · CVE-2026-31621

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bnge driver where the error path fails to return after calling the auxiliary device uninit() function. When auxiliary device add() fails, the system calls auxiliary device uninit(), which drops the last reference and triggers bnge aux dev release(). This process sets the bd->auxr dev variable to NULL and frees the underlying object. Because the code continues to execute, it attempts to access bd->auxr dev->net, resulting in a NULL pointer dereference during the error cleanup process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2026-31621

OPENSUSE-SU-2026:10703-1

Affected Products

Linux Kernel

References · 72

• https://ubuntu.com/security/CVE-2026-31621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31621 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31621 · Security Note
• https://git.kernel.org/stable/c/38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a · Patch
• https://git.kernel.org/stable/c/87bc3557c708110d83086bf091328271298a44e3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31621 · Vendor Advisory
• https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31621 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-31621 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10703-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31605 · Note
• https://suse.com/security/cve/CVE-2026-31606 · Note
• https://suse.com/security/cve/CVE-2026-31787 · Note
• https://suse.com/security/cve/CVE-2026-31626 · Note
• https://suse.com/security/cve/CVE-2026-31591 · Note