In the Linux kernel, the following vulnerability has been resolved:

mtd: core: avoid double-free of OTP NVMEM device

If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd otp nvmem add() unregisters the user device but leaves mtd->otp user nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again.

Clear mtd->otp user nvmem after unregistering it.