CVE-2026-98834

CVE-2026-98834

published October 18, 2026

CVSS
—
EPSS
0%
Percentile
4.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

mtd: core: avoid double-free of OTP NVMEM device

If factory OTP setup fails after the user OTP NVMEM device has been

registered, mtd_otp_nvmem_add() unregisters the user device but leaves

mtd->otp_user_nvmem set. On an error, the caller unregisters it again.

For -EOPNOTSUPP, registration continues and normal teardown unregisters

it again.

Clear mtd->otp_user_nvmem after unregistering it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00155 · 4.3th percentile
Published
2026-10-18T20:17Z
References (2)
https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 20 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 18 OCT 15:49Z
    mtd: core: avoid double-free of OTP NVMEM device
    cvelistv5
  • 18 OCT 15:49Z
    mtd: core: avoid double-free of OTP NVMEM device
    cvelistv5