CVE-2026-46285 mtd: docg3: fix use-after-free in docg3_release()

🗓️ 08 Jun 2026 15:41:28Reported by LinuxType

Resolved use after free in docg3_release by using cascade->bch directly and removing the docg3 local variable.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-46285	8 Jun 202615:41	–	attackerkb
CVE	CVE-2026-46285	8 Jun 202615:41	–	cve
Debian CVE	CVE-2026-46285	8 Jun 202615:41	–	debiancve
EUVD	EUVD-2026-35150	8 Jun 202615:41	–	euvd
NVD	CVE-2026-46285	8 Jun 202617:16	–	nvd
OSV	DEBIAN-CVE-2026-46285	8 Jun 202617:16	–	osv
Positive Technologies	PT-2026-47357	8 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-46285	8 Jun 202619:50	–	redhatcve
SUSE CVE	SUSE CVE-2026-46285	9 Jun 202602:21	–	susecve
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-46285	8 Jun 202600:00	–	nessus

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/mtd/devices/docg3.c"
    ],
    "versions": [
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "8408655ec8344511667b61d8257dc59c80ee3391",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "f5d2ed4ed47d3906e2495a3537a48b127f497a17",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "2bf706fe7831b319f23a85b9728f961cfed40c3e",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "d26f8c361f751c188b7ebaf8189aa0258968fd98",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "16f6588a3b7a2a20d10ad9b766be74c60ba347cc",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "d89044889ecd11b0c2f86663597246e9bdd25679",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "d49628d63d4e6bbc8a1621afb88e5fc901611bee",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
        "lessThan": "ca19808bc6fac7e29420d8508df569b346b3e339",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/mtd/devices/docg3.c"
    ],
    "versions": [
      {
        "version": "5.8",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.8",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.258",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.209",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.175",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.140",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.86",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.27",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0.4",
        "lessThanOrEqual": "7.0.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1-rc1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391
git	www.git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e
git	www.git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98
git	www.git.kernel.org/stable/c/f5d2ed4ed47d3906e2495a3537a48b127f497a17
git	www.git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679
git	www.git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee
git	www.git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc
git	www.git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339

08 Jun 2026 15:41Current