CVE-2026-46285
In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer. Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct, and is already available as a local variable. This also removes the now-unused docg3 local variable.
Affected versions
Linux kernel versions
5.8
and later are affected. Fixed in
5.10.258,
5.15.209,
6.1.175,
6.6.140,
6.12.86,
6.18.27,
7.0.4,
7.1-rc1
and their respective stable series.
References
The following references provide additional information about CVE-2026-46285 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc
-
PatchKernel patch commithttps://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e
-
PatchKernel patch commithttps://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391
Frequently asked questions
-
What is CVE-2026-46285?
CVE-2026-46285 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.8 onward and has been patched in 5.10.258, 5.15.209, 6.1.175 and others. CVE-2026-46285 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-46285?
Yes — CVE-2026-46285 has been patched. Fixed versions include 5.10.258, 5.15.209, 6.1.175 and others. If you are running Linux kernel 5.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-46285 actively exploited?
No — CVE-2026-46285 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.