CVE-2026-68416

In the Linux kernel, the following vulnerability has been resolved:

mtd: fix double free and WARNON in addmtd_device() error paths

When deviceregister() or mtdnvmemadd() fails inside addmtddevice() for a partition, the error handling triggers mtdrelease() via putdevice() or deviceunregister(). mtdrelease() calls releasemtdpartition() which frees the mtdinfo structure. However, callers such as mtdaddpartition() and addmtdpartitions() also call free_partition() in their error paths, resulting in a double free.

Additionally, releasemtdpartition() hits WARNON(!listempty( &mtd->part.node)) because the partition node is still linked in the parent's partitions list when the release callback fires from the addmtddevice() error path.

Fix this by overriding dev->type and dev->release before putdevice() in the error paths, so that devicerelease() invokes a no-op function instead of mtdrelease(). For the mtdnvmemadd() failure case, deviceunregister() is replaced with devicedel() to separate the device removal from the final kobject reference drop, allowing the override to take effect before putdevice() is called.

The callers' error paths (listdel + freepartition) remain the sole owners of mtdinfo lifetime on addmtd_device() failure, which is the expected contract.

The normal partition teardown path is not affected: delmtddevice() goes through krefput() -> mtddevicerelease() -> deviceunregister() with dev->type still set to &mtddevtype, so mtdrelease() -> releasemtdpartition() continues to work correctly for the regular removal case.