{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "5716e58aecdd4f7225c2e46ce903a839fc54f22f"
            },
            {
              "fixed": "ed5470771c7ed7f959230c4697f316af83426a90"
            },
            {
              "fixed": "7d228ba43279de2d191f25e139fad166409c2c06"
            },
            {
              "fixed": "42d217add8d80d6e7d9f58f80d11ea9b07ea113e"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.5.0"
            },
            {
              "fixed": "6.18.46"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74734.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: ohci: fix NULL pointer dereference in ar_context_release\n\nDuring the error handling path of the driver's probe function, a NULL\npointer dereference can occur in ar_context_release().\n\nWhen pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping\nfails), the devres cleanup mechanism invokes release_ohci(). This function\nunconditionally calls ar_context_release() to clean up the asynchronous\nreceive contexts. However, if ar_context_init() was not yet called,\nctx-\u003eohci remains NULL (as the fw_ohci structure is zero-initialized by\ndevres_alloc()).\n\nar_context_release() immediately dereferences ctx-\u003eohci to get the dev\npointer before checking if the context was actually initialized, leading to\na crash:\n\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nRIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543\nCall Trace:\n release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567\n release_nodes drivers/base/devres.c:546 [inline]\n devres_release_all+0x1a8/0x260 drivers/base/devres.c:576\n device_unbind_cleanup drivers/base/dd.c:597 [inline]\n really_probe+0x451/0xae0 drivers/base/dd.c:772\n\nTo fix this, move the assignment of the dev pointer after the !ctx-\u003ebuffer\ncheck. If ctx-\u003ebuffer is NULL, it indicates that the context was never\nsuccessfully initialized and there is nothing to release, safely avoiding\nthe dereference of the uninitialized ctx-\u003eohci pointer.",
  "id": "CVE-2026-74734",
  "modified": "2026-08-28T11:30:28.583002587Z",
  "published": "2026-08-26T14:36:48.753Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/42d217add8d80d6e7d9f58f80d11ea9b07ea113e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7d228ba43279de2d191f25e139fad166409c2c06"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ed5470771c7ed7f959230c4697f316af83426a90"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74734.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74734"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "firewire: ohci: fix NULL pointer dereference in ar_context_release"
}