Cloudanix VulnDB

CVE-2026-98834

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the way Linux handles certain internal memory cleanup for storage devices could let someone with access to the system cause crashes or run unwanted code.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double-free of an OTP NVMEM device pointer in the Linux kernel MTD core when factory OTP setup fails after user OTP registration, caused by failing to clear mtd->otp_user_nvmem after unregistering, enabling memory corruption.

Why it matters to the business

May lead to system instability, crashes, or potential code execution on Linux-based devices using MTD flash storage, increasing operational risk in embedded and server environments even with low observed exploitation likelihood.

How an attack unfolds

An attacker with local access triggers the specific error path in mtd_otp_nvmem_add during OTP setup to cause the double-free condition, potentially allowing manipulation of freed memory for privilege escalation or denial of service.

How to fix it

Update the Linux kernel to a version containing the fix that clears mtd->otp_user_nvmem after unregistering the device; apply all available kernel updates promptly given the recent public disclosure.

How to confirm the fix worked

Confirm the kernel source contains the patch clearing the otp_user_nvmem pointer after unregister; test OTP NVMEM registration error paths to verify no double-free occurs; review kernel changelog for the mtd core change.

Typical attack path

  1. Obtain local code execution on target system
  2. Trigger MTD OTP NVMEM registration failure after user device registration
  3. Force the error path that unregisters without clearing the pointer
  4. Re-trigger normal teardown to perform second free
  5. Leverage resulting memory corruption for further exploitation

How to detect it

Review kernel logs and crash dumps for MTD OTP NVMEM double-free or use-after-free signatures; examine audit logs for unusual OTP setup error sequences on systems with flash storage.

What your security team should do

  • Prioritize kernel updates on all Linux systems using MTD/OTP functionality within standard patch cycles
  • Monitor for new exploit maturity indicators given the memory corruption nature
  • Restrict local access on high-value systems until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but leaves mtd->otp_user_nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again. Clear mtd->otp_user_nvmem after unregistering it.

Affected packages

Ecosystem Package Introduced Fixed