CVE-2026-93048

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

mtd_add_partition() does not reject the special offset value

MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in

add_mtd_device() when called through the BLKPG ioctl on NAND

devices. The RETAIN value depends on cur_offset being the end of

the previous partition, but in the dynamic partition path

cur_offset equals the offset argument itself, causing undefined

behavior.

Commit 5daa7b21496a ("mtd: prepare partition add and del functions

for ioctl requests") introduced mtd_add_partition() and correctly

rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2),

since those special offsets rely on cur_offset tracking the

previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags

for partitions which should just leave smth. after them")

later added MTDPART_OFS_RETAIN (-3) for the static

partition table path without updating mtd_add_partition() t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References