Linux Kernel: Prevent Double-Free of OTP NVMEM Device
CVE-2026-98834 Published on October 18, 2026
mtd: core: avoid double-free of OTP NVMEM device
In the Linux kernel, the following vulnerability has been resolved:
mtd: core: avoid double-free of OTP NVMEM device
If factory OTP setup fails after the user OTP NVMEM device has been
registered, mtd_otp_nvmem_add() unregisters the user device but leaves
mtd->otp_user_nvmem set. On an error, the caller unregisters it again.
For -EOPNOTSUPP, registration continues and normal teardown unregisters
it again.
Clear mtd->otp_user_nvmem after unregistering it.
Products Associated with CVE-2026-98834
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 and below cecf007418b93a2cbc94269e07fe2fb28f54d8fb is affected.
- Version e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 and below 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 is affected.
- Version 6d1af517817a760d7af3dee0fc4603645485495c is affected.
- Version f1b4affca1e13706ca2eb075bf6775421236d7d1 is affected.
- Version 949476b8601bde5459048eebdf457c9db20addd8 is affected.
- Version dd6c85f98ff33b009b819090268cbf679dc208b9 is affected.
- Version 5.15.111 and below 5.16 is affected.
- Version 6.1.28 and below 6.2 is affected.
- Version 6.2.15 and below 6.3 is affected.
- Version 6.3.2 and below 6.4 is affected.
- Version 6.4 is affected.
- Before 6.4 is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.