CVE-2026-93048

CVE-2026-93048 affects the Linux kernel MTD partition subsystem. The function mtd_add_partition() fails to reject the special offset value MTDPART_OFS_RETAIN (-3) , which was originally added only for the static partition table path. When passed via the BLKPG ioctl on NAND devices, the RETAIN siz...

CVE-2026-90215

CVE-2026-90215 is a reference-count leak in the Linux kernel's MTD UBI (Unsorted Block Images) subsystem. The function ubi_detach_mtd_dev() obtains a device reference via ubi_get_device() before checking whether the UBI device is busy; on the busy return path it drops ubi->ref_count but leaves...

CVE-2026-90216

CVE-2026-90216 affects the UBI (Unsorted Block Images) module in the Linux kernel . The vulnerability resides in ubi_init_attach(), which rolls back module initialization failures by scanning only ubi_devices[0..i-1], where i is the mtd= parameter index. This logic incorrectly assumes the paramet...

CVE-2026-89954

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

EUVD-2026-80554

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

CVE-2026-89954 mtd: afs: validate v2 image info bounds

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

CVE-2026-89952

CVE-2026-89952 affects the Linux kernel's mtd: rawnand subsystem , specifically the nand_flash_detect_ext_param_page() function. The root cause is an insufficient bounds check: the function allocates memory based on the length declared in the ONFI parameter page, then reads a fixed header and wal...

EUVD-2026-80552

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: validate ONFI extended parameter page sections nandflashdetectextparampage allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fslupm: A bug in the funexecop function was fixed; a “off-by-one” test was corrected. The “op-cs” values are copied into “fun-mchipnumber”, which is used to access the “mchipoffsets” and “rnbgpio” arrays. These arra...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: lpddr2nvm: Fixed a possible null-ptr-deref issue. This issue could lead to a null-ptr-deref when the resourcesizeaddrange function is called, if the platformgetresource function returns NULL...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: Serialize lock/unlock operations in relation to other NAND operations. The functions nandlock and nandunlock involve calling chip-ops.lockarea/unlockarea, but they do not hold the NAND device lock. In controllers th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: denali: Use managed device resources All resources used by this driver have managed interfaces; therefore, use them. Otherwise, we will encounter the following error: 4.472703 denali-nand-pci 0000:00:05.0: Timeout...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mtd: maps: pxa2xx-flash: fixed a memory leak in the probe function. Added “free ‘info’” upon remapping errors to avoid memory leaks. : Reworded the commit log...

CVE-2026-80597

A flaw was found in the Linux kernel's mtd: maps: vmu-flash component. During the initialization of the Memory Technology Device MTD, a NULL pointer dereference can occur if the mtdinfo structure, which contains a device structure, is not properly linked to its parent. This issue can lead to the...

CVE-2026-80597

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

UBUNTU-CVE-2026-80597

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

CVE-2026-80597

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

EUVD-2026-67473

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

CVE-2026-80597

CVE-2026-80597 affects the Linux kernel 's mtd: maps: vmu-flash driver. During MTD initialization, the mtd_info structure's embedded struct device was not linked to its parent, causing a NULL pointer dereference that failed the MTD initialization process. The fix ensures the device is properly li...

CVE-2026-80597 mtd: maps: vmu-flash: fix NULL pointer dereference in initialization

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...