VulnerabilityPublished 17 Sep 2026Updated 19 Oct 2026

CVE-2026-93048: Linux kernel · mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e204e5c49a012f99638633fdbd773e3c86260053 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 15:59 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e204e5c49a012f99638633fdbd773e3c86260053, c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff, b759d5bb6265419344ee9729fd0dc07ad85719d8 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1a31368bf92ef2a7da3ba379672c405bd2751df9, < e204e5c49a012f99638633fdbd773e3c86260053	Fixed in e204e5c49a012f99638633fdbd773e3c86260053
LinuxLinux	Affected ≥ 1a31368bf92ef2a7da3ba379672c405bd2751df9, < c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff	Fixed in c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff
LinuxLinux	Affected ≥ 1a31368bf92ef2a7da3ba379672c405bd2751df9, < b759d5bb6265419344ee9729fd0dc07ad85719d8	Fixed in b759d5bb6265419344ee9729fd0dc07ad85719d8
LinuxLinux	Affected ≥ 1a31368bf92ef2a7da3ba379672c405bd2751df9, < a536eb57be58442b19398b2783071007ecfb1735	Fixed in a536eb57be58442b19398b2783071007ecfb1735
LinuxLinux	Affected ≥ 1a31368bf92ef2a7da3ba379672c405bd2751df9, < 701c3ae7273e1adc20db5d97c42e0139b479f16b	Fixed in 701c3ae7273e1adc20db5d97c42e0139b479f16b
LinuxLinux	Affected ≥ 1a31368bf92ef2a7da3ba379672c405bd2751df9, < 398aca2f90122d5abbabff1079deaeb885fe9e40	Fixed in 398aca2f90122d5abbabff1079deaeb885fe9e40

AI-suggested

A fix is available and has been applied in multiple Linux kernel commits. Users should update to a Linux kernel version that includes the fix identified by the commits listed in establishedFacts.fixedVersions. No additional mitigation is required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's mtd_add_partition() function allows the special offset value MTDPART_OFS_RETAIN (-3) to be used improperly, causing a WARN_ON condition and undefined behavior when adding partitions via the BLKPG ioctl on NAND devices. This occurs because MTDPART_OFS_RETAIN was not rejected like other special offset values, leading to underflow in partition size calculations and potential creation of invalid or disabled partitions.

Impact

This vulnerability can cause kernel warnings (WARN_ON) and undefined behavior in partition handling on NAND devices, potentially leading to invalid or disabled partitions. While it does not directly indicate remote code execution or privilege escalation, the undefined behavior and kernel warnings may affect system stability or reliability when managing MTD partitions dynamically.

Summary

The Linux kernel's mtd_add_partition() function did not reject the special offset MTDPART_OFS_RETAIN (-3), unlike other special offsets MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2). When offset=-3 is passed via the BLKPG ioctl on NAND devices, the size calculation underflows, causing either erasesize to be zero (triggering a WARN_ON in add_mtd_device()) or a bogus partition size that results in a disabled empty partition. This flaw arises from a missing check introduced after MTDPART_OFS_RETAIN was added for static partition tables but not handled in dynamic partition paths. The issue was fixed by adding MTDPART_OFS_RETAIN to the rejection list in mtd_add_partition(), aligning its handling with other special offsets.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 15:02 UTC

Technical details

References

Community reviews

Related threats