Not yet scoredPublished Oct 18, 2026

CVE-2026-98833mtd: core: call _get_device() with the master MTD

Updated under an hour ago (Oct 27, 2026, 4:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call _get_device() with the master MTD __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition. __put_mtd_device() passes the master. This breaks gluebi partitions because gluebi_get_device() uses container_of() and therefore requires the master MTD. Pass the master to _get_device(), matching _put_device().

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 46b5889cc2c54bac7d7e727a44d28a298df23cef before d94731cafa57e2c986ff391122d1494e5a3f3c3f; from 46b5889cc2c54bac7d7e727a44d28a298df23cef before 95c8f36293c22d450c371167ad4f9a5bbadc7539; from 46b5889cc2c54bac7d7e727a44d28a298df23cef before f971f1c63cf71579258360a12bd185bc1cd1a043; from 46b5889cc2c54bac7d7e727a44d28a298df23cef before dc482a281a19a7d7e91ad1b2d551bb301c54d0e6; 46b5889cc2c54bac7d7e727a44d28a298df23cef builds before 12b31d1acd20b3185bb5f0748db0cf6874c8e9d1	CNA record

References

References

https://git.kernel.org/stable/c/d94731cafa57e2c986ff391122d1494e5a3f3c3f
https://git.kernel.org/stable/c/95c8f36293c22d450c371167ad4f9a5bbadc7539
https://git.kernel.org/stable/c/f971f1c63cf71579258360a12bd185bc1cd1a043
https://git.kernel.org/stable/c/dc482a281a19a7d7e91ad1b2d551bb301c54d0e6
https://git.kernel.org/stable/c/12b31d1acd20b3185bb5f0748db0cf6874c8e9d1

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.