CVE-2026-98834 PUBLISHED

mtd: core: avoid double-free of OTP NVMEM device

Assigner: Linux
Reserved: 25.09.2026 Published: 18.10.2026 Updated: 18.10.2026

In the Linux kernel, the following vulnerability has been resolved:

mtd: core: avoid double-free of OTP NVMEM device

If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but leaves mtd->otp_user_nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again.

Clear mtd->otp_user_nvmem after unregistering it.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 to cecf007418b93a2cbc94269e07fe2fb28f54d8fb (excl.)
  • affected from e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 to 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 (excl.)
  • Version 6d1af517817a760d7af3dee0fc4603645485495c is affected
  • Version f1b4affca1e13706ca2eb075bf6775421236d7d1 is affected
  • Version 949476b8601bde5459048eebdf457c9db20addd8 is affected
  • Version dd6c85f98ff33b009b819090268cbf679dc208b9 is affected
  • affected from 5.15.111 to 5.16 (excl.)
  • affected from 6.1.28 to 6.2 (excl.)
  • affected from 6.2.15 to 6.3 (excl.)
  • affected from 6.3.2 to 6.4 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.4 is affected
  • unaffected from 0 to 6.4 (excl.)
  • unaffected from 7.2.10 to 7.2.* (incl.)
  • unaffected from 7.3-rc6 to * (incl.)

References