[PATCH] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()

Miquel Raynal miquel.raynal at bootlin.com
Mon Jun 29 07:39:38 PDT 2026


On Sun, 14 Jun 2026 01:10:52 -0700, Harshit Mogalapalli wrote:
> mtd_concat_destroy() frees item->concat so calling
> mtd_virt_concat_put_mtd_devices(item->concat) leads to a use after free.
> 
> Fix this by moving mtd_virt_concat_put_mtd_devices() before
> mtd_concat_destroy()
> 
> 
> [...]

Applied to mtd/fixes, thanks!

[1/1] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
      commit: 75c0c09541b49daa08fddbc2c18c2232f4eab7d8

Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).

Kind regards,
Miquèl




More information about the linux-mtd mailing list