{"id":"CVE-2026-98834","revision":"cb09f5e5b5344b50a0eb71623a7a0d0d","records":[{"revision":"cb09f5e5b5344b50a0eb71623a7a0d0d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98834","aliases":[],"title":"mtd: core: avoid double-free of OTP NVMEM device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: avoid double-free of OTP NVMEM device\n\nIf factory OTP setup fails after the user OTP NVMEM device has been\nregistered, mtd_otp_nvmem_add() unregisters the user device but leaves\nmtd->otp_user_nvmem set. On an error, the caller unregisters it again.\nFor -EOPNOTSUPP, registration continues and normal teardown unregisters\nit again.\n\nClear mtd->otp_user_nvmem after unregistering it.","state":0,"publishedAt":"2026-10-18T15:49:46.003+00:00","modifiedAt":"2026-10-19T09:26:26.676+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/mtd/mtdcore.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9\",\n                            \"lessThan\": \"cecf007418b93a2cbc94269e07fe2fb28f54d8fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9\",\n                            \"lessThan\": \"26300879cd8e4612dce66bb8f6ff7cd35fcf3e59\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6d1af517817a760d7af3dee0fc4603645485495c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f1b4affca1e13706ca2eb075bf6775421236d7d1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"949476b8601bde5459048eebdf457c9db20addd8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dd6c85f98ff33b009b819090268cbf679dc208b9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.15.111\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.28\",\n                            \"lessThan\": \"6.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.2.15\",\n                            \"lessThan\": \"6.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.3.2\",\n                            \"lessThan\": \"6.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/mtd/mtdcore.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb","https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98834","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98834","identifiers":["CVE-2026-98834"]},"retained":false,"historicalAffected":[]}],"coverage":[]}