Cloudanix VulnDB

CVE-2026-68416

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

An error-handling mistake in storage device setup could let the system free the same memory twice, leading to crashes on certain Linux devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Double free of mtd_info structure and WARN_ON due to incorrect release callback invocation on add_mtd_device() error paths for partitions, combined with callers also freeing the structure.

Why it matters to the business

Kernel instability, crashes, or memory corruption on embedded and flash-based Linux systems during partition registration failures, potentially affecting device availability and requiring reboots.

How an attack unfolds

An attacker with local access triggers error conditions in device_register or mtd_nvmem_add inside add_mtd_device for a partition, causing the double free path and possible use-after-free when the structure is freed twice.

How to fix it

Apply the upstream kernel patch that overrides dev->type and dev->release before put_device in error paths and replaces device_unregister with device_del for the nvmem case; update to a Linux kernel version containing this fix.

How to confirm the fix worked

Confirm the patch is present by inspecting the add_mtd_device error handling code for the release override logic; test partition addition with injected failures to ensure no double free or WARN_ON occurs.

Typical attack path

  1. Gain local access or trigger MTD partition addition
  2. Force failure in device_register or mtd_nvmem_add for the partition
  3. Trigger caller error path that also frees the partition structure
  4. Observe double free or list corruption leading to crash or memory issues

How to detect it

Review kernel logs and dmesg for double-free warnings, list corruption, or WARN_ON messages mentioning mtd partitions during device addition; inspect crash dumps for mtd_info structures freed in error paths.

What your security team should do

  • Prioritize kernel updates on systems using MTD partitions such as embedded and storage devices
  • Monitor kernel logs for WARN_ON related to mtd part.node after partition operations
  • Apply the fix promptly even on non-production systems to prevent latent crashes

The record

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device() error paths When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device() or device_unregister(). mtd_release() calls release_mtd_partition() which frees the mtd_info structure. However, callers such as mtd_add_partition() and add_mtd_partitions() also call free_partition() in their error paths, resulting in a double free. Additionally, release_mtd_partition() hits WARN_ON(!list_empty( &mtd->part.node)) because the partition node is still linked in the parent's partitions list when the release callback fires from the add_mtd_device() error path. Fix this by overriding dev->type and dev->release before put_device() in the error paths, so that device_release() invokes a no-op function instead of mtd_release(). For the mtd_nvmem_add() failure case, device_unregister() is replaced with device_del() to separate the device removal from the final kobject reference drop, allowing the override to take effect before put_device() is called. The callers' error paths (list_del + free_partition) remain the sole owners of mtd_info lifetime on add_mtd_device() failure, which is the expected contract. The normal partition teardown path is not affected: del_mtd_device() goes through kref_put() -> mtd_device_release() -> device_unregister() with dev->type still set to &mtd_devtype, so mtd_release() -> release_mtd_partition() continues to work correctly for the regular removal case.

Affected packages

Ecosystem Package Introduced Fixed