CVE-2026-98834: mtd: core: avoid double-free of OTP NVMEM device
In the Linux kernel, the following vulnerability has been resolved:
mtd: core: avoid double-free of OTP NVMEM device
If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd() unregisters the user device but leaves mtd->otpusernvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again.
Clear mtd->otpusernvmem after unregistering it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Clear mtd->otp_user_nvmem after unregistering the user OTP NVMEM device, preventing it from being unregistered again during teardown.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using MTD devices with OTP NVMEM support are relevant. The failure path requires factory OTP setup to fail after the user OTP NVMEM device has already been registered.
What condition triggers the double-free?
The issue occurs when mtd_otp_nvmem_add() unregisters the user OTP NVMEM device after a factory OTP setup failure but does not clear mtd->otp_user_nvmem. A caller error path, or normal teardown after an -EOPNOTSUPP result, can then unregister the same device again.
What can be done if updating is not immediately possible?
Avoid configurations or operations that exercise OTP NVMEM registration on affected MTD devices, particularly cases where factory OTP setup can fail after user OTP registration. The provided data does not identify a broader mitigation.