CVE-2026-98834
Received
Received - Intake
Double-Free in Linux Kernel MTD Core
Vulnerability report for CVE-2026-98834, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
mtd: core: avoid double-free of OTP NVMEM device
If factory OTP setup fails after the user OTP NVMEM device has been
registered, mtd_otp_nvmem_add() unregisters the user device but leaves
mtd->otp_user_nvmem set. On an error, the caller unregisters it again.
For -EOPNOTSUPP, registration continues and normal teardown unregisters
it again.
Clear mtd->otp_user_nvmem after unregistering it.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 |
| Linux | Linux | e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 |
| Linux | Linux | 6d1af517817a760d7af3dee0fc4603645485495c |
| Linux | Linux | f1b4affca1e13706ca2eb075bf6775421236d7d1 |
| Linux | Linux | 949476b8601bde5459048eebdf457c9db20addd8 |
| Linux | Linux | dd6c85f98ff33b009b819090268cbf679dc208b9 |
| Linux | Linux | 5.15.111 |
| Linux | Linux | 6.1.28 |
| Linux | Linux | 6.2.15 |
| Linux | Linux | 6.3.2 |
| Linux | Linux | 6.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
