---
id: CVE-2026-98834
title: 'mtd: core: avoid double-free of OTP NVMEM device'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: core: avoid double-free of OTP NVMEM device

  If factory OTP setup fails after the user OTP NVMEM device has been
  registered, mtd_otp_nvmem_add() unregisters the us…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 <
    cecf007418b93a2cbc94269e07fe2fb28f54d8fb
  - >-
    Linux >= e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 <
    26300879cd8e4612dce66bb8f6ff7cd35fcf3e59
  - Linux 6d1af517817a760d7af3dee0fc4603645485495c
  - Linux f1b4affca1e13706ca2eb075bf6775421236d7d1
  - Linux 949476b8601bde5459048eebdf457c9db20addd8
  - Linux dd6c85f98ff33b009b819090268cbf679dc208b9
  - Linux >= 5.15.111 < 5.16
  - Linux >= 6.1.28 < 6.2
  - Linux >= 6.2.15 < 6.3
  - Linux >= 6.3.2 < 6.4
  - Linux 6.4
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:49:46.003Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98834'
references:
  - url: 'https://git.kernel.org/stable/c/cecf007418b93a2cbc94269e07fe2fb28f54d8fb'
  - url: 'https://git.kernel.org/stable/c/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.469Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mtd: core: avoid double-free of OTP NVMEM device

If factory OTP setup fails after the user OTP NVMEM device has been
registered, mtd_otp_nvmem_add() unregisters the user device but leaves
mtd->otp_user_nvmem set. On an error, the caller unregisters it again.
For -EOPNOTSUPP, registration continues and normal teardown unregisters
it again.

Clear mtd->otp_user_nvmem after unregistering it.

## Affected

- `Linux >= e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 < cecf007418b93a2cbc94269e07fe2fb28f54d8fb`
- `Linux >= e0489f6e221f5ddee6cb3bd51b992b790c5fa4b9 < 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59`
- `Linux 6d1af517817a760d7af3dee0fc4603645485495c`
- `Linux f1b4affca1e13706ca2eb075bf6775421236d7d1`
- `Linux 949476b8601bde5459048eebdf457c9db20addd8`
- `Linux dd6c85f98ff33b009b819090268cbf679dc208b9`
- `Linux >= 5.15.111 < 5.16`
- `Linux >= 6.1.28 < 6.2`
- `Linux >= 6.2.15 < 6.3`
- `Linux >= 6.3.2 < 6.4`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.