Linux Kernel Vulnerability in OTP NVMEM Device Management

CVE-2026-98834

What is CVE-2026-98834?

A vulnerability exists in the Linux kernel that impacts the management of OTP (One-Time Programmable) NVMEM devices. When a factory OTP setup fails after a user OTP NVMEM device has been registered, a double-free condition can occur because the system improperly handles device unregistration. Specifically, the mtd_otp_nvmem_add() function unregisters the user device but fails to clear the reference to the otp_user_nvmem. This oversight can lead to instability within the kernel due to the potential for unintended memory handling errors, necessitating careful updates to prevent exploitation.

References