Cloudanix VulnDB

CVE-2026-98833

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in storage device handling can cause crashes or instability when certain flash memory partitions are used on Linux systems.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Mismatch between the MTD object passed to _get_device() versus _put_device() callbacks allows partition objects to reach gluebi_get_device() which performs container_of() expecting a master MTD, breaking reference counting and device lifetime handling for gluebi-backed partitions.

Why it matters to the business

Systems relying on MTD flash storage with gluebi partitions may experience crashes, failed device access, or resource leaks during normal storage operations, increasing downtime risk on embedded and server platforms that use flash subsystems.

How an attack unfolds

An attacker with local access triggers MTD partition operations that invoke __get_mtd_device() on a gluebi partition; the incorrect non-master pointer reaches gluebi_get_device() causing invalid container_of dereference or use-after-free conditions that can be leveraged for kernel memory corruption or denial of service.

How to fix it

Apply the upstream kernel patch that ensures the master MTD is always passed to both _get_device() and _put_device() callbacks; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the mtdcore.c source for the corrected call site passing the master device; test gluebi partition attach/detach sequences and verify no container_of or reference-count warnings appear in the kernel log.

Typical attack path

  1. Obtain local code execution on a Linux system exposing MTD devices
  2. Create or access a gluebi-backed MTD partition
  3. Perform get/put device operations that exercise the mismatched master/partition path
  4. Trigger container_of dereference or reference-count imbalance to corrupt kernel state

How to detect it

Review kernel logs for container_of warnings, invalid pointer dereferences, or oopses involving mtd or gluebi during partition attach/detach; correlate with processes performing MTD ioctl or block device operations.

What your security team should do

  • Prioritize kernel updates on any systems using MTD flash with gluebi partitions
  • Monitor vendor advisories for backported fixes in distribution kernels
  • Restrict local unprivileged access to MTD device nodes until patched

The record

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call _get_device() with the master MTD __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition. __put_mtd_device() passes the master. This breaks gluebi partitions because gluebi_get_device() uses container_of() and therefore requires the master MTD. Pass the master to _get_device(), matching _put_device().

Affected packages

Ecosystem Package Introduced Fixed