SB2026102456 - Double free in Linux kernel mtd driver

Description

This security bulletin contains information about 1 vulnerability.

1) Double free (CVE-ID: CVE-2026-98834)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a double free in the Linux kernel MTD core function mtd_otp_nvmem_add() when factory OTP setup fails after the user OTP NVMEM device has been registered. A local user can potentially trigger the affected error-handling or teardown path to cause a kernel crash because the device is unregistered without clearing mtd->otp_user_nvmem, allowing it to be unregistered again.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59
• https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb