CVE-2026-46285: mtd: docg3: fix use-after-free in docg3_release()
In the Linux kernel, the following vulnerability has been resolved:
mtd: docg3: fix use-after-free in docg3release()
In docg3release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls docreleasedevice() on each floor. docreleasedevice() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer.
Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct, and is already available as a local variable. This also removes the now-unused docg3 local variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Compensating control
In docg3_release(), access cascade->bch directly instead of dereferencing docg3->cascade->bch after docg3 has been freed; remove the now-unused docg3 local variable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46285?
CVE-2026-46285 has a risk rating of 31, indicating a moderate severity level.
How do I fix CVE-2026-46285?
To fix CVE-2026-46285, update the Linux kernel to the latest version that includes the patch for the use-after-free issue.
What systems are affected by CVE-2026-46285?
CVE-2026-46285 affects systems running the Linux kernel with mtd/docg3 support.
What is the impact of CVE-2026-46285?
The impact of CVE-2026-46285 involves potential exploitation due to a use-after-free vulnerability leading to undefined behavior.
When was CVE-2026-46285 published?
CVE-2026-46285 was published on June 8, 2026.