CVE-2026-98833: mtd: core: call _get_device() with the master MTD
In the Linux kernel, the following vulnerability has been resolved:
mtd: core: call getdevice() with the master MTD
getmtddevice() calls the master's getdevice() callback with mtd, which may be a partition. putmtddevice() passes the master.
This breaks gluebi partitions because gluebigetdevice() uses containerof() and therefore requires the master MTD. Pass the master to getdevice(), matching putdevice().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
Which systems are affected in practice?
Systems using Linux kernel MTD partitions with a master device whose _get_device() callback requires the master MTD are affected. The description specifically identifies gluebi partitions as broken because gluebi_get_device() uses container_of().
What condition triggers the issue?
The issue occurs when __get_mtd_device() invokes the master device's _get_device() callback but supplies a partition MTD instead of the master MTD. The mismatch is significant because __put_mtd_device() already passes the master device.
How can I determine whether a kernel includes the fix?
Check whether the kernel contains the change that makes __get_mtd_device() call _get_device() with the master MTD, matching __put_mtd_device(). The listed stable kernel references identify commits containing that correction.