PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46285 Linux CVE debrief

A use-after-free vulnerability was discovered in the Linux kernel's mtd: docg3 module. The vulnerability occurs in the docg3_release() function where the docg3 pointer is obtained from cascade->floors[0]->priv before a loop that calls doc_release_device() on each floor. The doc_release_device() function frees the docg3 struct via kfree(docg3). After the loop, docg3->cascade->bch dereferences the already-freed pointer. The vulnerability has been resolved by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct and is already available as a local variable.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel with the mtd: docg3 module enabled should be aware of this vulnerability. However, the vendor information is not available, and the product name is null.

Technical summary

The vulnerability is caused by a use-after-free error in the docg3_release() function. The function obtains the docg3 pointer from cascade->floors[0]->priv before a loop that calls doc_release_device() on each floor. The doc_release_device() function frees the docg3 struct via kfree(docg3). After the loop, docg3->cascade->bch dereferences the already-freed pointer. The fix accesses cascade->bch directly.

Defensive priority

medium

Recommended defensive actions

  • Apply the patches provided by the Linux kernel maintainers to fix the vulnerability.
  • Review and update the Linux kernel to ensure the fix is applied.

Evidence notes

The CVE record and NVD detail can be found at [cve-org] and [nvd] respectively.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46285 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46285

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46285 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46285

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.