CVE-2026-74734

firewire: ohci: fix NULL pointer dereference in ar_context_release

Published Aug 26, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

firewire: ohci: fix NULL pointer dereference in ar_context_release

During the error handling path of the driver's probe function, a NULL
pointer dereference can occur in ar_context_release().

When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping
fails), the devres cleanup mechanism invokes release_ohci(). This function
unconditionally calls ar_context_release() to clean up the asynchronous
receive contexts. However, if ar_context_init() was not yet called,
ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by
devres_alloc()).

ar_context_release() immediately dereferences ctx->ohci to get the dev
pointer before checking if the context was actually initialized, leading to
a crash:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543
Call Trace:
release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567
release_nodes drivers/base/devres.c:546 [inline]
devres_release_all+0x1a8/0x260 drivers/base/devres.c:576
device_unbind_cleanup drivers/base/dd.c:597 [inline]
really_probe+0x451/0xae0 drivers/base/dd.c:772

To fix this, move the assignment of the dev pointer after the !ctx->buffer
check. If ctx->buffer is NULL, it indicates that the context was never
successfully initialized and there is nothing to release, safely avoiding
the dereference of the uninitialized ctx->ohci pointer.

Analysis

Technical impact

The flaw originates in the Linux kernel’s Firewire OHCI driver, where the cleanup routine ar_context_release() dereferences a NULL pointer during probe error handling. This causes a kernel crash (general‑protection fault with KASAN reporting a null‑ptr‑deref), resulting in a Denial‑of‑Service that may reboot or halt the affected host. The weakness is a classic NULL‑pointer dereference that releases critical kernel resources.

Affected Systems

The issue affects all Linux kernel installations that include the Firewire OHCI driver, which is part of the default Firewire stack. Any kernel build that compiles or includes the firewire/ohci.c module when a device fails to initialize early during probe can trigger the crash. Specific affected release versions are not listed, so any kernel containing the unpatched driver is at risk.

Risk and Exploitability

The CVSS score is 5.5, indicating medium severity, and the EPSS score is <1%, indicating a very low exploitation probability. The presence of an uninitialized pointer in a kernel cleanup routine is a medium‑severity weakness. Since it is triggered during device probe, the attack vector is local and requires the kernel to load the OHCI driver, thus requiring at least system boot or privileged device insertion context. Because the bug is not tied to an external driver input, exploitation is unlikely from a network standpoint but can be leveraged by anyone able to influence device initialization, such as by inserting a faulty Firewire device or triggering a probe failure. The vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5716e58aecdd4f7225c2e46ce903a839fc54f22f`	affected	< 3770a4794a14331c8ca6a674e49c021827521c2c
`5716e58aecdd4f7225c2e46ce903a839fc54f22f`	affected	< ca2fa74f3200ced6e0a940753ad99844c42ad7c8
`5716e58aecdd4f7225c2e46ce903a839fc54f22f`	affected	< ed5470771c7ed7f959230c4697f316af83426a90
`5716e58aecdd4f7225c2e46ce903a839fc54f22f`	affected	< 7d228ba43279de2d191f25e139fad166409c2c06
`5716e58aecdd4f7225c2e46ce903a839fc54f22f`	affected	< 42d217add8d80d6e7d9f58f80d11ea9b07ea113e

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5716e58aecdd4f7225c2e46ce903a839fc54f22f,ed5470771c7ed7f959230c4697f316af83426a90)`	affected	code_commit	—
`[5716e58aecdd4f7225c2e46ce903a839fc54f22f,7d228ba43279de2d191f25e139fad166409c2c06)`	affected	code_commit	—
`[5716e58aecdd4f7225c2e46ce903a839fc54f22f,42d217add8d80d6e7d9f58f80d11ea9b07ea113e)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.5`	affected	generic	—
`[0,6.5)`	unaffected	generic	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the Firewire OHCI driver patch (commit 42d217add8d80d6e7d9f58f80d11ea9b07ea113e).
If updating immediately is not possible, disable the Firewire OHCI driver in the kernel configuration or unload the module to prevent the crash.
After applying the patch or disabling the driver, reboot the system to ensure the changes take effect.

Generated by OpenCVE AI on August 28, 2026 at 08:04 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4904-1	linux-6.12 security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.175% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3770a4794a14331c8ca6a674e49c021827521c2c
https://git.kernel.org/stable/c/42d217add8d80d6e7d9f58f80d11ea9b07ea113e
https://git.kernel.org/stable/c/7d228ba43279de2d191f25e139fad166409c2c06
https://git.kernel.org/stable/c/ca2fa74f3200ced6e0a940753ad99844c42ad7c8
https://git.kernel.org/stable/c/ed5470771c7ed7f959230c4697f316af83426a90
https://lore.kernel.org/linux-cve-announce/2026082653-CVE-2026-74734-fc5b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74734
https://www.cve.org/CVERecord?id=CVE-2026-74734

History

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3770a4794a14331c8ca6a674e49c021827521c2c https://git.kernel.org/stable/c/ca2fa74f3200ced6e0a940753ad99844c42ad7c8

Aug 27, 2026 6:00 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026082653-CVE-2026-74734-fc5b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74734 https://www.cve.org/CVERecord?id=CVE-2026-74734
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Aug 26, 2026 3:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

Aug 26, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in ar_context_release During the error handling path of the driver's probe function, a NULL pointer dereference can occur in ar_context_release(). When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping fails), the devres cleanup mechanism invokes release_ohci(). This function unconditionally calls ar_context_release() to clean up the asynchronous receive contexts. However, if ar_context_init() was not yet called, ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by devres_alloc()). ar_context_release() immediately dereferences ctx->ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543 Call Trace: release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567 release_nodes drivers/base/devres.c:546 [inline] devres_release_all+0x1a8/0x260 drivers/base/devres.c:576 device_unbind_cleanup drivers/base/dd.c:597 [inline] really_probe+0x451/0xae0 drivers/base/dd.c:772 To fix this, move the assignment of the dev pointer after the !ctx->buffer check. If ctx->buffer is NULL, it indicates that the context was never successfully initialized and there is nothing to release, safely avoiding the dereference of the uninitialized ctx->ohci pointer.
Title		firewire: ohci: fix NULL pointer dereference in ar_context_release
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/42d217add8d80d6e7d9f58f80d11ea9b07ea113e https://git.kernel.org/stable/c/7d228ba43279de2d191f25e139fad166409c2c06 https://git.kernel.org/stable/c/ed5470771c7ed7f959230c4697f316af83426a90