CVE-2026-46285

A flaw was found in the Linux kernel's mtd: docg3 module. The docg3release function attempts to access memory that has already been deallocated, leading to a use-after-free vulnerability. This issue could allow a local attacker to cause a denial of service or potentially execute arbitrary code...

CVE-2026-46285

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3release In docg3release, the docg3 pointer is obtained from cascade-floors0-priv before the loop that calls docreleasedevice on each floor. docreleasedevice frees the docg3 struct via...

CVE-2026-46285

In the Linux kernel vulnerability CVE-2026-46285, a use-after-free occurs in mtd: docg3_release(): the docg3 pointer is obtained from cascade->floors[0]->priv and freed via doc_release_device() in a loop. After freeing docg3, code dereferences docg3->cascade->bch, which is undefined b...

CVE-2026-46285 mtd: docg3: fix use-after-free in docg3_release()

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3release In docg3release, the docg3 pointer is obtained from cascade-floors0-priv before the loop that calls docreleasedevice on each floor. docreleasedevice frees the docg3 struct via...

CVE-2026-46285

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3release In docg3release, the docg3 pointer is obtained from cascade-floors0-priv before the loop that calls docreleasedevice on each floor. docreleasedevice frees the docg3 struct via...

EUVD-2026-35150

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3release In docg3release, the docg3 pointer is obtained from cascade-floors0-priv before the loop that calls docreleasedevice on each floor. docreleasedevice frees the docg3 struct via...

PT-2026-47357

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3 release In docg3 release, the docg3 pointer is obtained from cascade-floors0-priv before the loop that calls doc release device on each floor. doc release device frees the docg3 struct via...