Cloudanix VulnDB

CVE-2026-93049

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug in flash memory swap handling could cause crashes or memory problems when certain setup errors occur.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double-free of mbd_dev structure in mtdswap_add_mtd error path after successful blktrans registration when debugfs setup fails, because pointer is not cleared before falling through to kfree.

Why it matters to the business

Kernel instability, crashes, or memory corruption on Linux systems using MTD-based swap, potentially affecting embedded or storage devices during device registration failures.

How an attack unfolds

Local attacker or faulty hardware triggers mtdswap_add_mtd with a debugfs setup failure after blktrans registration succeeds, causing the double-free in the common cleanup label.

How to fix it

Apply the upstream kernel patch that clears the local pointer after del_mtd_blktrans_dev in the debugfs failure path; rebuild and deploy updated kernel images.

How to confirm the fix worked

Inspect mtdswap.c for the added pointer-clearing statement after del_mtd_blktrans_dev and confirm absence of double kfree on mbd_dev in error paths via static analysis or code review.

Typical attack path

  1. Invoke mtdswap_add_mtd to register blktrans device
  2. Force debugfs setup failure after registration
  3. Execute del_mtd_blktrans_dev followed by kfree on the same pointer
  4. Trigger use-after-free when blktrans reference count reaches zero

How to detect it

Search kernel logs and dmesg for messages indicating double-free, use-after-free, or oops in mtdswap or blktrans_dev_release functions.

What your security team should do

  • Prioritize kernel updates containing the mtdswap double-free fix
  • Test MTD swap registration paths in lab environments before production rollout
  • Monitor kernel logs for oops or warnings referencing mtd_blktrans_dev_release

The record

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswap_add_mtd(), debugfs setup failure after successful blktrans registration can free mbd_dev twice. add_mtd_blktrans_dev() initializes the blktrans device reference and publishes the disk. Once that succeeds, del_mtd_blktrans_dev() tears the disk down and drops the blktrans reference; when that reference reaches zero, blktrans_dev_release() frees the mtd_blktrans_dev. The debugfs failure path called del_mtd_blktrans_dev(mbd_dev), then fell through the common cleanup label and called kfree(mbd_dev) again. Clear the local pointer after deregistration so the common cleanup can still release the mtdswap state without freeing the blktrans object twice. This issue was found by a static analysis checker and confirmed by manual source review.

Affected packages

Ecosystem Package Introduced Fixed