VulnerabilityPublished 10 Aug 2026Updated 30 Oct 2026

CVE-2026-68416: Linux kernel · mtd: fix double free and WARN_ON in add_mtd_device() error paths

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ffe21a3545b439e7b11578a701c22a847c149561 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 13:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Patch: Available – fixed in ffe21a3545b439e7b11578a701c22a847c149561, f98ae09c727dcf34f745c875661c64b642e4abfa, e1e96aca1bdf391e2f49531c270ffc134e5b49a5 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 19bfa9ebebb5ec0695def57eb1d80de7e9cab369, < ffe21a3545b439e7b11578a701c22a847c149561	Fixed in ffe21a3545b439e7b11578a701c22a847c149561
LinuxLinux	Affected ≥ 19bfa9ebebb5ec0695def57eb1d80de7e9cab369, < f98ae09c727dcf34f745c875661c64b642e4abfa	Fixed in f98ae09c727dcf34f745c875661c64b642e4abfa
LinuxLinux	Affected ≥ 19bfa9ebebb5ec0695def57eb1d80de7e9cab369, < e1e96aca1bdf391e2f49531c270ffc134e5b49a5	Fixed in e1e96aca1bdf391e2f49531c270ffc134e5b49a5
LinuxLinux	Affected ≥ 93c08951d7070134b7415ca4abd0d25876aa653b, < b1f78dc4a6869e30ff64345a5d3e7da1b6da0061	Fixed in b1f78dc4a6869e30ff64345a5d3e7da1b6da0061
LinuxLinux	Affected ≥ 19bfa9ebebb5ec0695def57eb1d80de7e9cab369, < 820f983d641937a787e841ee4b93501f69f5683e	Fixed in 820f983d641937a787e841ee4b93501f69f5683e
LinuxLinux	Affected ≥ 19bfa9ebebb5ec0695def57eb1d80de7e9cab369, < 9d4af746af8ce27eefc2338b2feaa1e01f28b6c3	Fixed in 9d4af746af8ce27eefc2338b2feaa1e01f28b6c3

AI-suggested

A fix is available and has been applied in Linux kernel version 6.6. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are required as the fix addresses the root cause in the kernel code.

Description

A double free and WARN_ON issue was fixed in the Linux kernel's add_mtd_device() error paths. The flaw occurred when error handling in device registration or partition addition caused multiple frees of the same memory structure and a warning due to a still-linked partition node. The fix changes device release behavior in error paths to prevent double freeing and ensures proper partition lifetime management.

Impact

The issue could lead to a double free vulnerability causing potential kernel instability or crashes due to memory corruption. The WARN_ON indicates a kernel warning that could affect system reliability. There is no indication of exploitation in the wild or direct security compromise beyond stability impact.

Summary

The vulnerability in the Linux kernel involves a double free and WARN_ON triggered in the add_mtd_device() error handling paths. Specifically, when device_register() or mtd_nvmem_add() fails during add_mtd_device() for a partition, error handling calls mtd_release() via put_device() or device_unregister(), which frees the mtd_info structure. However, other callers also free this structure in their error paths, causing a double free. Additionally, release_mtd_partition() triggers WARN_ON because the partition node remains linked in the parent's partitions list when the release callback fires. The fix overrides dev->type and dev->release before put_device() in error paths to invoke a no-op release function instead of mtd_release(), preventing double free. For the mtd_nvmem_add() failure, device_unregister() is replaced with device_del() to separate device removal from the final reference drop, allowing the override to take effect. Normal partition teardown remains unaffected. This fix is applied in Linux kernel version 6.6.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 13:33 UTC

Technical details

References

Community reviews

Related threats