Executive brief
A vulnerability was identified in the Linux kernel's Non-Volatile Memory (NVMEM) subsystem, which manages access to hardware like EEPROMs. In certain error scenarios, the system could attempt to use memory that has already been released, potentially leading to system instability or crashes. This issue primarily affects the internal reliability of the operating system during specific hardware interaction failures.
Technical details
A use-after-free vulnerability exists in the Linux kernel's NVMEM (Non-Volatile Memory) core subsystem within `drivers/nvmem/core.c`. The issue stems from improper reference counting in error handling paths, specifically within functions like `of_nvmem_cell_get`. The code would call `__nvmem_device_put()`, which potentially frees the underlying `nvmem` structure, but then continues to access members of that structure (such as `nvmem->layout`) to determine return codes. An attacker with the ability to trigger these specific error paths could potentially cause a kernel crash or achieve arbitrary code execution. The fix involves reordering the operations to ensure the reference to the NVMEM device is only released as the final step before returning.
Affected products
- Linux Linux Kernel 4.20 to 7.1
Timeline
- 2026-05-30: other: Initial fix authored by Bartosz Golaszewski
- 2026-06-25: disclosed: CVE published to NVD dataset