CVE-2026-98834 - Vulnerability Details

- mtd: core: avoid double-free of OTP NVMEM device

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: core: avoid double-free of OTP NVMEM device

If factory OTP setup fails after the user OTP NVMEM device has been
registered, mtd_otp_nvmem_add() unregisters the user device but leaves
mtd->otp_user_nvmem set. On an error, the caller unregisters it again.
For -EOPNOTSUPP, registration continues and normal teardown unregisters
it again.

Clear mtd->otp_user_nvmem after unregistering it.

Published: 2026-10-18

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A double‑free bug in the Linux kernel’s MTD OTP NVMEM subsystem emerges when a factory OTP setup fails after a user OTP NVMEM device has been registered. The routine mtd_otp_nvmem_add() unregisters the device but fails to clear the internal mtd->otp_user_nvmem pointer. A subsequent unregister attempt frees the already freed memory again. This mis‑management of kernel memory placement is classified under CWE-1341 and can corrupt critical kernel data structures.

Affected Systems

All Linux kernel builds that incorporate the MTD OTP NVMEM module are vulnerable, regardless of the exact kernel release. Because the code path exists across multiple kernel configurations, any kernel revision with this module compiled in may allow the double‑free if the conditions above are triggered.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. The probable attack vector is local or privileged: an actor who can induce a factory OTP setup failure or otherwise trigger the double‑unregister sequence can corrupt kernel memory, potentially leading to a denial‑of‑service or, under specific conditions, arbitrary code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9`	affected	< cecf007418b93a2cbc94269e07fe2fb28f54d8fb
`e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9`	affected	< 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59
`6d1af517817a760d7af3dee0fc4603645485495c`	affected	—
`f1b4affca1e13706ca2eb075bf6775421236d7d1`	affected	—
`949476b8601bde5459048eebdf457c9db20addd8`	affected	—
`dd6c85f98ff33b009b819090268cbf679dc208b9`	affected	—
`5.15.111`	affected	< 5.16
`6.1.28`	affected	< 6.2
`6.2.15`	affected	< 6.3
`6.3.2`	affected	< 6.4

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9,cecf007418b93a2cbc94269e07fe2fb28f54d8fb)`	affected	code_commit	—
`[e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9,26300879cd8e4612dce66bb8f6ff7cd35fcf3e59)`	affected	code_commit	—
`6d1af517817a760d7af3dee0fc4603645485495c`	affected	code_commit	—
`f1b4affca1e13706ca2eb075bf6775421236d7d1`	affected	code_commit	—
`949476b8601bde5459048eebdf457c9db20addd8`	affected	code_commit	—
`dd6c85f98ff33b009b819090268cbf679dc208b9`	affected	code_commit	—
`[5.15.111,5.16)`	affected	semver	—
`[6.1.28,6.2)`	affected	semver	—
`[6.2.15,6.3)`	affected	semver	—
`[6.3.2,6.4)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	semver	—
`[0,6.4)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel version provided by your distribution that contains the fixed commit 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 or patch ce cf007418b93a2cbc94269e07fe2fb28f54d8fb, which clears mtd->otp_user_nvmem after unregistration.
If an updated kernel package is unavailable, manually apply the corrective commit to the kernel source, rebuild, and reinstall the kernel to guarantee the pointer reset is active.
As a temporary measure, disable the MTD OTP NVMEM module (e.g., set CONFIG_MTD_OTP_NVMEM to 'n') in the kernel configuration to eliminate the vulnerable code path until the patch is deployed.

Generated by OpenCVE AI on October 24, 2026 at 04:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00155.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98834.mbox
https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59
https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb
https://nvd.nist.gov/vuln/detail/CVE-2026-98834
https://www.cve.org/CVERecord?id=CVE-2026-98834

History

Sat, 24 Oct 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98834.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98834 https://www.cve.org/CVERecord?id=CVE-2026-98834
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but leaves mtd->otp_user_nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again. Clear mtd->otp_user_nvmem after unregistering it.
Title		mtd: core: avoid double-free of OTP NVMEM device
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:49:46.003Z

Updated: 2026-10-19T09:26:26.676Z

Reserved: 2026-09-25T10:25:14.372Z

Link: CVE-2026-98834

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:37.633

Modified: 2026-10-19T10:19:47.420

Link: CVE-2026-98834

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98834 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T04:30:08Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object