CVE-2026-68416

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mtd: fix double free and WARN_ON in add_mtd_device() error paths

When device_register() or mtd_nvmem_add() fails inside

add_mtd_device() for a partition, the error handling triggers

mtd_release() via put_device() or device_unregister(). mtd_release()

calls release_mtd_partition() which frees the mtd_info structure.

However, callers such as mtd_add_partition() and add_mtd_partitions()

also call free_partition() in their error paths, resulting in a double

free.

Additionally, release_mtd_partition() hits WARN_ON(!list_empty(

&mtd->part.node)) because the partition node is still linked in the

parent's partitions list when the release callback fires from the

add_mtd_device() error path.

Fix this by overriding dev->type and dev->release before put_device()

in the error paths, so that device_release() invokes a no-op function

instead of mtd_release(). For the mtd_nvmem_add() failure case,

device_unregister() is replaced w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References