CVE Explorer

CVE-2026-46285

In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer. Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:1e19004890158819bbfa54b826621da4fd1694584ee80e046209971651df6e84

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mtd/devices/docg3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"les…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mtd/devices/docg3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8408655ec8344511667b61d8257dc59c80ee3391","status":"affected","version":"c8ae3f744ddca0da164bcacee42d1d4b6fe7027d","versionType":"git"},{"lessThan":"f5d2ed4ed47d3906e2495a3537a48b127f497a17","status":"affected","version":"c8ae3f744ddca0da164bcacee42d1d4b6fe7027d","versionType":"git"},{"lessThan":"2bf706fe7831b319f23a85b9728f961cfed40c3e","status":"affected","version":"c8ae3f744ddca0da16…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/affected/0

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/f5d2ed4ed47d3906e2495a3537a48b127f497a17"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:edb46d4601eee83d8f4b8a510e0f80804dcb1b951cde2682b1380a6549ac0955 · sha256:94fe3341dc488bf7… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer