CVE-2026-68416

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free and a WARN ON condition exist in the add mtd device() error paths. When device register() or mtd nvmem add() fails, the error handling triggers mtd release() via put device() or device unregister(), which calls release mtd partition() to free the mtd info structure. Simultaneously, callers like mtd add partition() and add mtd partitions() call free partition() in their own error paths, leading to the double free. Furthermore, release mtd partition() triggers a WARN ON because the partition node remains linked in the parent's partitions list when the release callback is executed. The issue is resolved by overriding dev->type and dev->release before put device() to ensure a no-op function is invoked instead of mtd release(), and by replacing device unregister() with device del() in the mtd nvmem add() failure case.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.