Double Free Vulnerability in Linux Kernel Affects Device Management

CVE-2026-68416

What is CVE-2026-68416?

A vulnerability exists in the Linux kernel where the add_mtd_device() function could trigger a double free scenario during error handling. This occurs when device_register() or mtd_nvmem_add() fails, leading to an improper release of resources. The error paths incorrectly manage the mtd_info structure, allowing for potential memory corruption. The resolution involves modifying device release functions during error states to ensure correct resource management, thus preventing crashes or unexpected behavior in the kernel.

References