CVE-2026-68416
Received Received - Intake

Double Free and WARN_ON in Linux Kernel MTD Subsystem

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device() error paths When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device() or device_unregister(). mtd_release() calls release_mtd_partition() which frees the mtd_info structure. However, callers such as mtd_add_partition() and add_mtd_partitions() also call free_partition() in their error paths, resulting in a double free. Additionally, release_mtd_partition() hits WARN_ON(!list_empty( &mtd->part.node)) because the partition node is still linked in the parent's partitions list when the release callback fires from the add_mtd_device() error path. Fix this by overriding dev->type and dev->release before put_device() in the error paths, so that device_release() invokes a no-op function instead of mtd_release(). For the mtd_nvmem_add() failure case, device_unregister() is replaced with device_del() to separate the device removal from the final kobject reference drop, allowing the override to take effect before put_device() is called. The callers' error paths (list_del + free_partition) remain the sole owners of mtd_info lifetime on add_mtd_device() failure, which is the expected contract. The normal partition teardown path is not affected: del_mtd_device() goes through kref_put() -> mtd_device_release() -> device_unregister() with dev->type still set to &mtd_devtype, so mtd_release() -> release_mtd_partition() continues to work correctly for the regular removal case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68416
EUVD
EUVD-2026-55602

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a double free and WARN_ON issue in the add_mtd_device() function. When device_register() or mtd_nvmem_add() fails during partition handling, error paths trigger mtd_release() which frees the mtd_info structure. However, callers like mtd_add_partition() also attempt to free it, causing a double free. Additionally, a WARN_ON is triggered because the partition node remains linked in the parent's list.

Detection Guidance

This vulnerability is specific to the Linux kernel's MTD (Memory Technology Device) subsystem and does not have direct network-based detection methods. It manifests during MTD device or partition handling errors. Check kernel logs for WARN_ON messages or double-free errors related to mtd devices using: dmesg | grep -i "mtd\|double free\|WARN_ON"

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or unexpected behavior due to the double free issue. It may cause kernel panics or instability in systems using MTD (Memory Technology Device) partitions, potentially affecting storage devices or embedded systems relying on this functionality.

Mitigation Strategies

Apply the kernel patch that fixes this issue. Update your Linux kernel to a version containing the fix for CVE-2026-68416. Monitor kernel logs for related errors after applying the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart