CVE-2026-74734

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

firewire: ohci: fix NULL pointer dereference in ar_context_release

During the error handling path of the driver's probe function, a NULL

pointer dereference can occur in ar_context_release().

When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping

fails), the devres cleanup mechanism invokes release_ohci(). This function

unconditionally calls ar_context_release() to clean up the asynchronous

receive contexts. However, if ar_context_init() was not yet called,

ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by

devres_alloc()).

ar_context_release() immediately dereferences ctx->ohci to get the dev

pointer before checking if the context was actually initialized, leading to

a crash:

Oops: general protection fault, probably for non-canonical address

0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

RIP: 0010:ar_co

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References