CVE-2026-93048

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

mtd_add_partition() does not reject the special offset value
MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in
add_mtd_device() when called through the BLKPG ioctl on NAND
devices. The RETAIN value depends on cur_offset being the end of
the previous partition, but in the dynamic partition path
cur_offset equals the offset argument itself, causing undefined
behavior.

Commit 5daa7b21496a ("mtd: prepare partition add and del functions
for ioctl requests") introduced mtd_add_partition() and correctly
rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2),
since those special offsets rely on cur_offset tracking the
previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags
for partitions which should just leave smth. after them")
later added MTDPART_OFS_RETAIN (-3) for the static
partition table path without updating mtd_add_partition() to
also reject this value.

With offset=-3 passed via BLKPG, the RETAIN size calculation in
allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD
= parent_size + 3). If the underflow result does not appear to
leave enough space, allocate_partition() jumps to out_register via
goto, skipping erasesize initialization. This results in
erasesize=0, which triggers:

WARN_ON((!mtd->erasesize || !master->_erase) &&
!(mtd->flags & MTD_NO_ERASE))

in add_mtd_device(). If the underflow result appears to leave
enough space, a bogus partition size is calculated, but the
"out of reach" sanity check catches the invalid offset and
creates a disabled empty partition (offset=0, size=0) instead
of returning an error.

Fix this by adding MTDPART_OFS_RETAIN to the rejection list in
mtd_add_partition(), consistent with the existing handling of
APPEND and NXTBLK.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< 701c3ae7273e1adc20db5d97c42e0139b479f16b
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< 6aaab2ace3f7b55733d904e5549acf8405f03642
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< 181c1bff940e7d3e34ca485d37e3cdbfe409203c
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< a536eb57be58442b19398b2783071007ecfb1735
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< e204e5c49a012f99638633fdbd773e3c86260053
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< 398aca2f90122d5abbabff1079deaeb885fe9e40
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff
`1a31368bf92ef2a7da3ba379672c405bd2751df9`	affected	< b759d5bb6265419344ee9729fd0dc07ad85719d8

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,701c3ae7273e1adc20db5d97c42e0139b479f16b)`	affected	code_commit	—
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,6aaab2ace3f7b55733d904e5549acf8405f03642)`	affected	code_commit	—
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,181c1bff940e7d3e34ca485d37e3cdbfe409203c)`	affected	code_commit	—
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,a536eb57be58442b19398b2783071007ecfb1735)`	affected	code_commit	—
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,e204e5c49a012f99638633fdbd773e3c86260053)`	affected	code_commit	—
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,398aca2f90122d5abbabff1079deaeb885fe9e40)`	affected	code_commit	—
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff)`	affected	code_commit	—
`[1a31368bf92ef2a7da3ba379672c405bd2751df9,b759d5bb6265419344ee9729fd0dc07ad85719d8)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.2`	affected	semver	—
`[0,3.2)`	unaffected	semver	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/181c1bff940e7d3e34ca485d37e3cdbfe409203c
https://git.kernel.org/stable/c/398aca2f90122d5abbabff1079deaeb885fe9e40
https://git.kernel.org/stable/c/6aaab2ace3f7b55733d904e5549acf8405f03642
https://git.kernel.org/stable/c/701c3ae7273e1adc20db5d97c42e0139b479f16b
https://git.kernel.org/stable/c/a536eb57be58442b19398b2783071007ecfb1735
https://git.kernel.org/stable/c/b759d5bb6265419344ee9729fd0dc07ad85719d8
https://git.kernel.org/stable/c/c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff
https://git.kernel.org/stable/c/e204e5c49a012f99638633fdbd773e3c86260053

History

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd_add_partition() does not reject the special offset value MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value depends on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior. Commit 5daa7b21496a ("mtd: prepare partition add and del functions for ioctl requests") introduced mtd_add_partition() and correctly rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2), since those special offsets rely on cur_offset tracking the previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them") later added MTDPART_OFS_RETAIN (-3) for the static partition table path without updating mtd_add_partition() to also reject this value. With offset=-3 passed via BLKPG, the RETAIN size calculation in allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD = parent_size + 3). If the underflow result does not appear to leave enough space, allocate_partition() jumps to out_register via goto, skipping erasesize initialization. This results in erasesize=0, which triggers: WARN_ON((!mtd->erasesize \|\| !master->_erase) && !(mtd->flags & MTD_NO_ERASE)) in add_mtd_device(). If the underflow result appears to leave enough space, a bogus partition size is calculated, but the "out of reach" sanity check catches the invalid offset and creates a disabled empty partition (offset=0, size=0) instead of returning an error. Fix this by adding MTDPART_OFS_RETAIN to the rejection list in mtd_add_partition(), consistent with the existing handling of APPEND and NXTBLK.
Title		mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/181c1bff940e7d3e34ca485d37e3cdbfe409203c https://git.kernel.org/stable/c/398aca2f90122d5abbabff1079deaeb885fe9e40 https://git.kernel.org/stable/c/6aaab2ace3f7b55733d904e5549acf8405f03642 https://git.kernel.org/stable/c/701c3ae7273e1adc20db5d97c42e0139b479f16b https://git.kernel.org/stable/c/a536eb57be58442b19398b2783071007ecfb1735 https://git.kernel.org/stable/c/b759d5bb6265419344ee9729fd0dc07ad85719d8 https://git.kernel.org/stable/c/c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff https://git.kernel.org/stable/c/e204e5c49a012f99638633fdbd773e3c86260053