CVE-2026-46285

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer. Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct, and is already available as a local variable. This also removes the now-unused docg3 local variable.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc	Patch
https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e	Patch
https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391	Patch
https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339	Patch
https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98	Patch
https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee	Patch
https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679	Patch
https://git.kernel.org/stable/c/f5d2ed4ed47d3906e2495a3537a48b127f497a17	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-06-08 17:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-46285

Mitre link : CVE-2026-46285

CVE.ORG link : CVE-2026-46285

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2026-46285", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "8408655ec8344511667b61d8257dc59c80ee3391", "versionType": "git"}, {"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "f5d2ed4ed47d3906e2495a3537a48b127f497a17", "versionType": "git"}, {"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "2bf706fe7831b319f23a85b9728f961cfed40c3e", "versionType": "git"}, {"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "d26f8c361f751c188b7ebaf8189aa0258968fd98", "versionType": "git"}, {"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "16f6588a3b7a2a20d10ad9b766be74c60ba347cc", "versionType": "git"}, {"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "d89044889ecd11b0c2f86663597246e9bdd25679", "versionType": "git"}, {"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "d49628d63d4e6bbc8a1621afb88e5fc901611bee", "versionType": "git"}, {"status": "affected", "version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d", "lessThan": "ca19808bc6fac7e29420d8508df569b346b3e339", "versionType": "git"}], "programFiles": ["drivers/mtd/devices/docg3.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"status": "unaffected", "version": "0", "lessThan": "5.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.140", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.86", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.27", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.4", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/mtd/devices/docg3.c"], "defaultStatus": "affected"}]}], "published": "2026-06-08T17:16:46.347", "references": [{"url": "https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f5d2ed4ed47d3906e2495a3537a48b127f497a17", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: docg3: fix use-after-free in docg3_release()\n\nIn docg3_release(), the docg3 pointer is obtained from\ncascade->floors[0]->priv before the loop that calls\ndoc_release_device() on each floor. doc_release_device() frees the\ndocg3 struct via kfree(docg3) at line 1881. After the loop,\ndocg3->cascade->bch dereferences the already-freed pointer.\n\nFix this by accessing cascade->bch directly, which is equivalent\nsince docg3->cascade points back to the same cascade struct, and\nis already available as a local variable. This also removes the\nnow-unused docg3 local variable."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmtd: docg3: corregir uso despu\u00e9s de liberaci\u00f3n en docg3_release()\n\nEn docg3_release(), el puntero docg3 se obtiene de cascade->floors[0]->priv antes del bucle que llama a doc_release_device() en cada floor. doc_release_device() libera la estructura docg3 a trav\u00e9s de kfree(docg3) en la l\u00ednea 1881. Despu\u00e9s del bucle, docg3->cascade->bch desreferencia el puntero ya liberado.\n\nSolucione esto al acceder a cascade->bch directamente, lo cual es equivalente ya que docg3->cascade apunta de nuevo a la misma estructura cascade, y ya est\u00e1 disponible como una variable local. Esto tambi\u00e9n elimina la variable local docg3 ahora no utilizada."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40E51E64-6FFB-47A5-B645-DC521C2C3E90", "versionEndExcluding": "5.10.258", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74", "versionEndExcluding": "6.18.27", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}