CVE-2026-98834

Received Received - Intake

Double-Free in Linux Kernel MTD Core

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but leaves mtd->otp_user_nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again. Clear mtd->otp_user_nvmem after unregistering it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98834

EUVD

EUVD-2026-103774

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9
Linux	Linux	e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9
Linux	Linux	6d1af517817a760d7af3dee0fc4603645485495c
Linux	Linux	f1b4affca1e13706ca2eb075bf6775421236d7d1
Linux	Linux	949476b8601bde5459048eebdf457c9db20addd8
Linux	Linux	dd6c85f98ff33b009b819090268cbf679dc208b9
Linux	Linux	5.15.111
Linux	Linux	6.1.28
Linux	Linux	6.2.15
Linux	Linux	6.3.2
Linux	Linux	6.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a double-free issue in the MTD (Memory Technology Device) subsystem. When factory OTP (One-Time Programmable) setup fails after registering the user OTP NVMEM device, the function mtd_otp_nvmem_add() unregisters the user device but does not clear the mtd->otp_user_nvmem pointer. This can lead to the device being unregistered again during normal teardown, causing a double-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's MTD subsystem and involves a double-free issue in OTP NVMEM device handling. Detection requires checking kernel logs for OTP-related errors or examining the MTD subsystem for abnormal device unregistration events.

Impact Analysis

This vulnerability could lead to system instability or crashes due to the double-free error. It may cause kernel panics or unexpected behavior in systems using MTD devices with OTP functionality, potentially disrupting services that rely on these devices.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue that could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for OTP-related errors and ensure no double-free conditions occur during device unregistration. Update affected systems to a patched kernel version.

Hi! I’m here to help you understand CVE-2026-98834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70