In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails… (CVE-2026-98834)

The vulnerability in the Linux kernel's mtd core involves a double-free condition of the OTP NVMEM device. Specifically, if the factory OTP setup fails after the user OTP NVMEM device has been registered, the function mtd_otp_nvmem_add() unregisters the user device but leaves the mtd->otp_user_nvmem pointer set. On error, the caller unregisters the device again, causing a double-free. Additionally, for the -EOPNOTSUPP error, registration continues and normal teardown unregisters the device again, also leading to double-free. The fix clears the mtd->otp_user_nvmem pointer after unregistering to prevent this condition.

This vulnerability can lead to kernel memory corruption due to double-free, potentially causing system instability or crashes. There is no information about exploitation in the wild or direct security impact such as privilege escalation or information disclosure.

A fix has been implemented in the Linux kernel to clear the mtd->otp_user_nvmem pointer after unregistering the device, preventing the double-free condition. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated.