CVE-2026-93048: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

CVE-2026-93048: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

mtd_add_partition() does not reject the special offset value
MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in
add_mtd_device() when called through the BLKPG ioctl on NAND
devices. The RETAIN value depends on cur_offset being the end of
the previous partition, but in the dynamic partition path
cur_offset equals the offset argument itself, causing undefined
behavior.

Commit 5daa7b21496a ("mtd: prepare partition add and del functions
for ioctl requests") introduced mtd_add_partition() and correctly
rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2),
since those special offsets rely on cur_offset tracking the
previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags
for partitions which should just leave smth. after them")
later added MTDPART_OFS_RETAIN (-3) for the static
partition table path without updating mtd_add_partition() to
also reject this value.

With offset=-3 passed via BLKPG, the RETAIN size calculation in
allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD
= parent_size + 3). If the underflow result does not appear to
leave enough space, allocate_partition() jumps to out_register via
goto, skipping erasesize initialization. This results in
erasesize=0, which triggers:

WARN_ON((!mtd->erasesize || !master->_erase) &&
		!(mtd->flags & MTD_NO_ERASE))

in add_mtd_device(). If the underflow result appears to leave
enough space, a bogus partition size is calculated, but the
"out of reach" sanity check catches the invalid offset and
creates a disabled empty partition (offset=0, size=0) instead
of returning an error.

Fix this by adding MTDPART_OFS_RETAIN to the rejection list in
mtd_add_partition(), consistent with the existing handling of
APPEND and NXTBLK.

The Linux kernel CVE team has assigned CVE-2026-93048 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 5.10.270 with commit 701c3ae7273e1adc20db5d97c42e0139b479f16b
	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 5.15.221 with commit 6aaab2ace3f7b55733d904e5549acf8405f03642
	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.1.188 with commit 181c1bff940e7d3e34ca485d37e3cdbfe409203c
	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.6.157 with commit a536eb57be58442b19398b2783071007ecfb1735
	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.12.110 with commit e204e5c49a012f99638633fdbd773e3c86260053
	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.18.52 with commit 398aca2f90122d5abbabff1079deaeb885fe9e40
	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 7.2.6 with commit c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff
	Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 7.3-rc1 with commit b759d5bb6265419344ee9729fd0dc07ad85719d8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-93048
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/mtd/mtdpart.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/701c3ae7273e1adc20db5d97c42e0139b479f16b
	https://git.kernel.org/stable/c/6aaab2ace3f7b55733d904e5549acf8405f03642
	https://git.kernel.org/stable/c/181c1bff940e7d3e34ca485d37e3cdbfe409203c
	https://git.kernel.org/stable/c/a536eb57be58442b19398b2783071007ecfb1735
	https://git.kernel.org/stable/c/e204e5c49a012f99638633fdbd773e3c86260053
	https://git.kernel.org/stable/c/398aca2f90122d5abbabff1079deaeb885fe9e40
	https://git.kernel.org/stable/c/c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff
	https://git.kernel.org/stable/c/b759d5bb6265419344ee9729fd0dc07ad85719d8