NetSight
IP …
high7.8

CVE-2026-46285

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer is …

Impact

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer. Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct, and is already available as a local variable. This also removes the now-unused docg3 local variable.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.8 before 5.10.258
from 5.11 before 5.15.209
from 5.16 before 6.1.175
from 6.2 before 6.6.140
from 6.7 before 6.12.86
from 6.13 before 6.18.27

Weakness classification

CWE-416

References