CVE-2026-80597
Description
A flaw was found in the Linux kernel's mtd: maps: vmu-flash component. During the initialization of the Memory Technology Device (MTD), a NULL pointer dereference can occur if the mtd_info structure, which contains a device structure, is not properly linked to its parent. This issue can lead to the failure of the MTD initialization, potentially causing system instability or a denial of service.
Statement
A flaw of moderate severity was found in the Linux kernel's mtd vmu-flash map driver. The mtd_info structure contains a struct device that must be linked to its parent; when this link is absent, initialization of the Memory Technology Device (MTD) fails with a NULL pointer dereference, which can crash the kernel and cause a local denial of service (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat has assessed all Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) components as Not Affected because the vulnerable vmu-flash driver code is not present in the kernels shipped for these products, so no Red Hat offering is exposed to this flaw.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
