CVE-2026-93049: mtd: mtdswap: Avoid freeing registered blktrans device twice
In the Linux kernel, the following vulnerability has been resolved:
mtd: mtdswap: Avoid freeing registered blktrans device twice
In mtdswapaddmtd(), debugfs setup failure after successful blktrans registration can free mbddev twice.
addmtdblktransdev() initializes the blktrans device reference and publishes the disk. Once that succeeds, delmtdblktransdev() tears the disk down and drops the blktrans reference; when that reference reaches zero, blktransdevrelease() frees the mtdblktransdev.
The debugfs failure path called delmtdblktransdev(mbddev), then fell through the common cleanup label and called kfree(mbddev) again. Clear the local pointer after deregistration so the common cleanup can still release the mtdswap state without freeing the blktrans object twice.
This issue was found by a static analysis checker and confirmed by manual source review.
Event History
Frequently Asked Questions
Does this require a debugfs setup failure to occur?
Yes. The double-free path is reached when debugfs setup fails after the blktrans device has already been successfully registered and published.
Is successful blktrans registration alone enough to trigger the issue?
No. The affected path requires subsequent debugfs setup failure; deregistration then frees the blktrans object, and the common cleanup path attempts to free it again.