Cloudanix VulnDB

CVE-2026-89582

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in Linux network driver code could let an attacker crash servers or take control by mishandling memory during card setup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double free of three kernel pointers (init_ops, init_data, init_ops_offsets) in bnx2x_init_firmware error path when followed by bnx2x_release_firmware, enabling memory corruption.

Why it matters to the business

Kernel crashes or memory corruption on Linux systems using bnx2x network drivers, raising risk of unplanned downtime and potential local privilege escalation.

How an attack unfolds

An attacker forces an error during bnx2x firmware initialization, then triggers the subsequent release path so the same pointers are freed twice, allowing manipulation of freed memory for code execution.

How to fix it

Apply the upstream kernel fix that sets the three pointers to NULL after kfree in the bnx2x_init_firmware error path.

How to confirm the fix worked

Inspect bnx2x_init_firmware and bnx2x_release_firmware in kernel source for the NULL assignments after kfree; confirm via kernel version or patch presence.

Typical attack path

  1. Trigger error condition inside bnx2x_init_firmware
  2. Cause bnx2x_release_firmware to be invoked later
  3. Exploit resulting double-free memory state

How to detect it

Search kernel logs and crash dumps for bnx2x-related oops or double-free warnings during driver initialization or device removal.

What your security team should do

  • Update to a kernel containing the bnx2x double-free fix
  • Prioritize systems exposing bnx2x NICs to untrusted environments
  • Review kernel logs for bnx2x oops during driver load/unload

The record

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2x_init_firmware() error path bnx2x_init_firmware() frees bp->init_ops, bp->init_data and bp->init_ops_offsets in its error path without setting them to NULL. The cleanup function bnx2x_release_firmware() frees the same three pointers unconditionally, so if init_firmware fails and release_firmware is later called (e.g. from __bnx2x_remove or through the function state machine), all three are freed a second time. Set each pointer to NULL after kfree() in the error path so that the subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.

Affected packages

Ecosystem Package Introduced Fixed