In the Linux kernel, the bnge subsystem contains a flaw in its cleanup path for auxiliary devices. When allocation of an auxiliary device descriptor fails, the error routine calls bnge_aux_dev_release(), which unconditionally dereferences a pointer that has not yet been allocated. This NULL pointer dereference can cause the kernel to crash, resulting in a denial of service. The weakness is a classic NULL pointer dereference, identified as CWE-476.

All Linux kernel installations that include the bnge auxiliary device code and have not yet incorporated the commit that replaces the release callback. Any system running a kernel derived from the affected source tree remains at risk until the patch is applied.

The CVSS score of 5.5 indicates a medium severity impact, while the EPSS score of <1% denotes a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker capable of triggering the faulty error path during device initialization or removal, such as by loading a malicious driver or manipulating hardware that interfaces with the bnge subsystem. Based on the description, it is inferred that the attacker must provoke an allocation failure to reach the unsafe release callback, which limits exploitability but does not eliminate the risk of a kernel panic.