CVE-2026-68424

Not scored yetLast modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()

mtd_concat_destroy() frees item->concat so calling mtd_virt_concat_put_mtd_devices(item->concat) leads to a use after free.

Fix this by moving mtd_virt_concat_put_mtd_devices() before mtd_concat_destroy()

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 43db6366fc2de02050e66389f5628d3fdc9af10a, < 4d91d783f93430c0efa834daff6640c07d87ebbc; >= 43db6366fc2de02050e66389f5628d3fdc9af10a, < 75c0c09541b49daa08fddbc2c18c2232f4eab7d8
LinuxLinux7.1

References

Timeline

Published
Aug 10, 2026
Last modified
Aug 17, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-684257.1In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handledCVE-2026-684269.8In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_CVE-2026-684277.8In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __hCVE-2026-68428In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_cCVE-2026-68429In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topologyCVE-2026-68435.5A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory wCVE-2026-68430In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUG_ON() There's no need to crash theCVE-2026-684319.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive paCVE-2026-684328.8In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnCVE-2026-684338.6In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_versioCVE-2026-68434In the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNCVE-2026-68435In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup Whe
CVE-2026-68424: Unscored | Vulnix