---
id: "CVE-2026-98834"
kind: "vulnerability"
aliases: ["CVE-2026-98834"]
title: "Linux kernel MTD: OTP NVMEM device can be freed twice on error"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "kernel", "linux", "mtd", "runtime"]
not_affected_if: ["no-mtd-otp-devices"]
published_at: "2026-10-18T16:17:37+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:13:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98834", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel MTD: OTP NVMEM device can be freed twice on error

When factory OTP setup fails in the MTD subsystem, the user OTP NVMEM device is unregistered but its pointer is left set, so it can be unregistered a second time. The sources describe a double-free, but do not state what an attacker gains from it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the upstream commit clearing mtd->otp_user_nvmem after unregistering it
- unknown

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98834

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

mtd: core: avoid double-free of OTP NVMEM device

If factory OTP setup fails after the user OTP NVMEM device has been
registered, mtd_otp_nvmem_add() unregisters the user device but leaves
mtd->otp_user_nvmem set. On an error, the caller unregisters it again.
For -EOPNOTSUPP, registration continues and normal teardown unregisters
it again.

Clear mtd->otp_user_nvmem after unregistering it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_