---
id: CVE-2026-93049
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: mtdswap: Avoid freeing registered blktrans device twice

  In mtdswap_add_mtd(), debugfs setup failure after successful blktrans
  registration can free mbd_dev twice.…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: mtdswap: Avoid freeing registered blktrans device twice

  In mtdswap_add_mtd(), debugfs setup failure after successful blktrans
  registration can free mbd_dev twice.…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    ecadb9137aeaa0615183f8d23eabea2b45c862f1
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    eec130fc9ffbbd08a5d5432683122b79aca2a726
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    d5086911d532b82ca070d944aa08ddde00baefe4
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    0ce48c6ddea1a8e675a2eb0221b62a9950788f3c
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    a82d93fcfdfd26af17049c34319dfdd079cd1901
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    5c349c533e72af2313c3be0f80a24d7407fa4777
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    37be7bc2c2d09c18e939da20224405864a0090b9
  - >-
    Linux >= e8e3edb95ce6a146bc774b6cfad3553f4383edc8 <
    779aa4c66a96bf43d2d62982ea1a9096a9128d87
  - Linux 4.14
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:58.223'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93049'
references:
  - url: 'https://git.kernel.org/stable/c/0ce48c6ddea1a8e675a2eb0221b62a9950788f3c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/37be7bc2c2d09c18e939da20224405864a0090b9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5c349c533e72af2313c3be0f80a24d7407fa4777'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/779aa4c66a96bf43d2d62982ea1a9096a9128d87'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a82d93fcfdfd26af17049c34319dfdd079cd1901'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d5086911d532b82ca070d944aa08ddde00baefe4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ecadb9137aeaa0615183f8d23eabea2b45c862f1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eec130fc9ffbbd08a5d5432683122b79aca2a726'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.771Z'
epss: 0.0021
epssPercentile: 0.11551
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mtd: mtdswap: Avoid freeing registered blktrans device twice

In mtdswap_add_mtd(), debugfs setup failure after successful blktrans
registration can free mbd_dev twice.

add_mtd_blktrans_dev() initializes the blktrans device reference and
publishes the disk. Once that succeeds, del_mtd_blktrans_dev() tears the
disk down and drops the blktrans reference; when that reference reaches
zero, blktrans_dev_release() frees the mtd_blktrans_dev.

The debugfs failure path called del_mtd_blktrans_dev(mbd_dev), then fell
through the common cleanup label and called kfree(mbd_dev) again. Clear
the local pointer after deregistration so the common cleanup can still
release the mtdswap state without freeing the blktrans object twice.

This issue was found by a static analysis checker and confirmed by
manual source review.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.