Linux Kernel CVE-2026-31621

The bnge (Broadcom NetXtreme) driver uses the Linux auxiliary bus subsystem (auxiliary_device API) to manage auxiliary devices. The vulnerability stems from incorrect error handling in device initialization: when auxiliary_device_add() fails, the code calls auxiliary_device_uninit(), which decrements the reference count and synchronously invokes the release callback bnge_aux_dev_release(). This callback sets bd->auxr_dev to NULL and deallocates the underlying object. The missing return statement causes execution to continue past the error block, where code attempts bd->auxr_dev->net = bd->netdev, resulting in a null pointer dereference (CWE-908: Use of Uninitialized Variable / incorrect cleanup). The issue affects kernel versions prior to commits 38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a and 87bc3557c708110d83086bf091328271298a44e3.