---
id: CVE-2026-89953
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: mtdoops: free page bitmap when the backing MTD is removed

  mtdoops_notify_add() allocates oops_page_used when the configured MTD
  device is registered
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: mtdoops: free page bitmap when the backing MTD is removed

  mtdoops_notify_add() allocates oops_page_used when the configured MTD
  device is registered.  mtdoops_not…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    477d61d54e097e90f748aa18d013805abd56bcbd
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    a91ac71e67c3e01ed9afd9841435bebb930293f8
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    698944132083d143ef965c0090ee14ba1d9e1a5f
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    f25c804947e0a28c15e73da8e2e0db959cbed716
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    8414f0e9f707226de20b48c7048179fd86d352fc
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    d06f91a52af11630c9f7e487f6daf242ac310cb8
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    1e5cd8bc902331ff801df88cbb299029ae062753
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    956e7da12c114f13c63d126ab1d79c3b6a819060
  - Linux 2.6.33
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:17:05.530'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89953'
references:
  - url: 'https://git.kernel.org/stable/c/1e5cd8bc902331ff801df88cbb299029ae062753'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/477d61d54e097e90f748aa18d013805abd56bcbd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/698944132083d143ef965c0090ee14ba1d9e1a5f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8414f0e9f707226de20b48c7048179fd86d352fc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/956e7da12c114f13c63d126ab1d79c3b6a819060'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a91ac71e67c3e01ed9afd9841435bebb930293f8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d06f91a52af11630c9f7e487f6daf242ac310cb8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f25c804947e0a28c15e73da8e2e0db959cbed716'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.962Z'
epss: 0.0021
epssPercentile: 0.11549
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mtd: mtdoops: free page bitmap when the backing MTD is removed

mtdoops_notify_add() allocates oops_page_used when the configured MTD
device is registered.  mtdoops_notify_remove() detaches from that device
but leaves the bitmap allocated.  If the same MTD device is later
registered again, the add path allocates a new bitmap and overwrites the
old pointer, leaking one vmalloc allocation per remove/add cycle.

This is only visible when the backing MTD device can disappear and be
registered again while mtdoops remains loaded, so the usual static MTD
case does not expose it.

Free the bitmap after unregistering the dumper and flushing the pending
workers, then clear the pointer and page count before a later attach can
allocate fresh state.  Clearing the pointer also keeps the module exit
path from freeing the same bitmap a second time after a remove event.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.