{"id":"CVE-2026-98834","kind":"vulnerability","aliases":["CVE-2026-98834"],"related":[],"title":"Linux kernel MTD: OTP NVMEM device can be freed twice on error","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: avoid double-free of OTP NVMEM device\n\nIf factory OTP setup fails after the user OTP NVMEM device has been\nregistered, mtd_otp_nvmem_add() unregisters the user device but leaves\nmtd->otp_user_nvmem set. On an error, the caller unregisters it again.\nFor -EOPNOTSUPP, registration continues and normal teardown unregisters\nit again.\n\nClear mtd->otp_user_nvmem after unregistering it.","summary":"When factory OTP setup fails in the MTD subsystem, the user OTP NVMEM device is unregistered but its pointer is left set, so it can be unregistered a second time. The sources describe a double-free, but do not state what an attacker gains from it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","kernel","linux","mtd","runtime"],"not_affected_if":["no-mtd-otp-devices"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit clearing mtd->otp_user_nvmem after unregistering it\n- unknown","status":"open","published_at":"2026-10-18T16:17:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:17+00:00","updated_at":"2026-10-25T05:13:17+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:13:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit clearing mtd->otp_user_nvmem after unregistering it\n- unknown","reach":"local","title":"Linux kernel MTD: OTP NVMEM device can be freed twice on error","impact":"medium","summary":"When factory OTP setup fails in the MTD subsystem, the user OTP NVMEM device is unregistered but its pointer is left set, so it can be unregistered a second time. The sources describe a double-free, but do not state what an attacker gains from it.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","mtd","embedded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; double-free may crash the kernel or corrupt memory","analyst_note":"Check the upstream kernel commit and stable backports to confirm affected version ranges and whether the double-free is reachable by an unprivileged user.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-mtd-otp-devices"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000549,"input_tokens":3402,"output_tokens":418,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98834':15A,18A 'add':106C 'attack':67B 'avoid':81C 'caller':122C 'clear':136C 'continu':129C 'core':80C 'cve':13A,16A 'describ':56B 'devic':6A,37B,88C,99C,110C 'doubl':59B,83C 'double-fre':58B,82C 'embed':19B 'eopnotsupp':127C 'error':12A,120C 'factori':25B,90C 'fail':28B,93C 'follow':74C 'free':60B,84C 'freed':9A 'gain':68B 'kernel':2A,20B,72C 'leav':112C 'left':44B 'linux':1A,21B,71C 'mtd':3A,22B,31B,79C,103C,113C,137C 'normal':131C 'nvmem':5A,36B,87C,98C,105C,116C,140C 'otp':4A,26B,35B,86C,91C,97C,104C,114C,138C 'pointer':42B 'regist':102C 'registr':128C 'resolv':78C 'runtim':23B 'second':52B 'set':45B,117C 'setup':27B,92C 'sourc':55B 'state':64B 'subsystem':32B 'teardown':132C 'time':53B 'twice':10A 'unregist':39B,50B,107C,123C,133C,142C 'user':34B,96C,109C,115C,139C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98834","severity":null,"published_at":"2026-10-18T16:17:37+00:00","modified_at":"2026-10-19T10:19:47+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}