Executive brief
A vulnerability was identified in the Linux kernel's DiskOnChip G3 (docg3) flash memory driver. This flaw could cause the system to crash or behave unpredictably when the device driver is being unloaded or released. While primarily a stability issue, such flaws can sometimes be exploited to disrupt system operations.
Technical details
A use-after-free vulnerability exists in the docg3_release() function within drivers/mtd/devices/docg3.c. The issue occurs because the code attempts to dereference a pointer (docg3->cascade->bch) after the underlying docg3 structure has already been freed by doc_release_device() via kfree(). An attacker with the ability to trigger driver release sequences could potentially cause a kernel oops or memory corruption. The fix involves accessing the 'cascade' structure directly from a local variable that remains valid, rather than through the freed 'docg3' pointer.
Affected products
- Linux Linux Kernel versions including docg3 MTD driver
Timeline
- 2026-03-09: other: Patch authored
- 2026-06-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc
- https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e
- https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391
- https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339
- https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98
- https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee
- https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679