Use-After-Free Vulnerability in Linux Kernel's MTD Subsystem

CVE-2026-68424

What is CVE-2026-68424?

A use-after-free vulnerability has been identified in the MTD (Memory Technology Device) subsystem of the Linux kernel. The issue arises during the destruction of concatenated MTD devices, where freeing the concatenated object led to a reference being used after it was freed. This flaw occurs in the mtd_virt_concat_destroy_joins() function, specifically when mtd_virt_concat_put_mtd_devices() is invoked after the memory has been released. A fix has been implemented to reposition the device management call before the concatenated object is freed, thereby preventing the potential exploitation of this vulnerability.

References