Executive brief
The Linux kernel's mtdoops module, which records kernel oops messages to flash memory devices (MTD), fails to properly free allocated memory when the backing MTD device is removed. When the same MTD device is re-registered while the module remains loaded, the old memory allocation is leaked. This is a memory leak issue that would accumulate over repeated device removal and re-registration cycles.
Technical details
This is a memory leak vulnerability in the mtdoops driver's device removal path. The mtdoops_notify_add() function allocates a bitmap (oops_page_used) when an MTD device is registered. However, mtdoops_notify_remove() fails to free this allocation when the device is unregistered. If the MTD device is later re-registered, the add path allocates a new bitmap and overwrites the old pointer without freeing it, creating a vmalloc leak per remove/add cycle. The fix adds three lines to mtdoops_notify_remove() to call vfree() on the bitmap, clear the pointer to NULL, and reset the page count. This scenario is only exposed when the backing MTD device can dynamically disappear and re-register while the mtdoops module remains loaded, not in typical static MTD configurations.
Affected products
- Linux Linux kernel all versions with mtdoops support (kernel 2.6.11 onwards)
Timeline
- 2026-09-16: disclosed: Published on NVD
- 2026-09-11: patched: Patch merged by Greg Kroah-Hartman into stable tree