Executive brief
The Linux kernel's slram (simulated RAM) MTD device driver has a memory management bug where partially initialized device entries remain on a global list if initialization fails. This can lead to system crashes or undefined behavior during device cleanup, affecting systems using simulated RAM block devices.
Technical details
The vulnerability is a use-after-free and double-free issue in the register_device() function of drivers/mtd/devices/slram.c. The function links a new slram_mtdlist entry to the global list before completing allocation of all required state (MTD info structure, memory mapping, device registration). If any of these later allocations fail (memremap or mtd_device_register), the partially initialized entry remains linked to the list with invalid or freed pointers. Subsequent cleanup code dereferencing or freeing this corrupted entry causes memory corruption. The fix adds proper error handling paths that unwind and remove failed entries from the list. No authentication is required; local or root-level access during device initialization is needed to trigger the vulnerability.
Affected products
- Linux Linux kernel 2.6.12 and later
Timeline
- 2026-08-15: disclosed
- 2026-06-09: patched: Fix committed upstream
- 2026-07-24: other: Backported to stable kernels