---
id: CVE-2026-89953
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: mtdoops: free page bitmap when the backing MTD is removed

  mtdoops_notify_add() allocates oops_page_used when the configured MTD
  device is registered
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: mtdoops: free page bitmap when the backing MTD is removed

  mtdoops_notify_add() allocates oops_page_used when the configured MTD
  device is registered.  mtdoops_not…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    477d61d54e097e90f748aa18d013805abd56bcbd
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    a91ac71e67c3e01ed9afd9841435bebb930293f8
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    698944132083d143ef965c0090ee14ba1d9e1a5f
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    f25c804947e0a28c15e73da8e2e0db959cbed716
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    8414f0e9f707226de20b48c7048179fd86d352fc
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    d06f91a52af11630c9f7e487f6daf242ac310cb8
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    1e5cd8bc902331ff801df88cbb299029ae062753
  - >-
    Linux >= be95745f01677245a061a8f51473ef5ec8ad008e <
    956e7da12c114f13c63d126ab1d79c3b6a819060
  - Linux 2.6.33
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:17:05.530'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89953'
references:
  - url: 'https://git.kernel.org/stable/c/1e5cd8bc902331ff801df88cbb299029ae062753'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/477d61d54e097e90f748aa18d013805abd56bcbd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/698944132083d143ef965c0090ee14ba1d9e1a5f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8414f0e9f707226de20b48c7048179fd86d352fc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/956e7da12c114f13c63d126ab1d79c3b6a819060'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a91ac71e67c3e01ed9afd9841435bebb930293f8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d06f91a52af11630c9f7e487f6daf242ac310cb8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f25c804947e0a28c15e73da8e2e0db959cbed716'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89953.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89953'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535157'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89953'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89953'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89953.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-16T10:53:53.962Z'
epss: 0.00216
epssPercentile: 0.11989
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-772
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mtd: mtdoops: free page bitmap when the backing MTD is removed

mtdoops_notify_add() allocates oops_page_used when the configured MTD
device is registered.  mtdoops_notify_remove() detaches from that device
but leaves the bitmap allocated.  If the same MTD device is later
registered again, the add path allocates a new bitmap and overwrites the
old pointer, leaking one vmalloc allocation per remove/add cycle.

This is only visible when the backing MTD device can disappear and be
registered again while mtdoops remains loaded, so the usual static MTD
case does not expose it.

Free the bitmap after unregistering the dumper and flushing the pending
workers, then clear the pointer and page count before a later attach can
allocate fresh state.  Clearing the pointer also keeps the module exit
path from freeing the same bitmap a second time after a remove event.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6 · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89953.json)