From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30691527581 for ; Thu, 17 Sep 2026 16:34:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662865; cv=none; b=LvGgO3yYvJJjxSk+RGZngiG4rBy10jgmUbk3Ek4RL7EEV/Yh27BlgxuH81DuyyRXzaemA7U0NKXo9P0SwCeUgVziiHdZp/l8rQYvqVFFXx7BfLv4syRYxADc57E6SkWpiWBCLWYRIjYELmzfEPX9iTgXdpcmtA0e3uqnSR0KjNA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789662865; c=relaxed/simple; bh=jQ0hv240VvSsgWLWxtVpx6bJg3GY92V9vQCmm08KDH4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=I9VRXuVNcZ1LuEL400V740EPTxqvuxQl8T4X9ioAYQ1YA3ei7DjBFlbsRgT6ysKfxUXeLV7HK1JFS7Wbk7MhQzq24XMi6DcizHeyxoohHZxXmWRnp1LO5IDe+EFbx0bBSq+ah8Swa9R6l7t0aeIGqnoIP8OEe0Em0IdM6yQ3M40= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pl9R2v9x; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="pl9R2v9x" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 88CCD1F000FF; Thu, 17 Sep 2026 16:34:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789662864; bh=RgcE3ExoRckGlXE+Qfu2SgqooqjB5APkjrTYHdpR1xg=; h=From:To:Cc:Subject:Date:Reply-To; b=pl9R2v9xPrgeIxML9r7V77fBVjv4zQj//y4YMVkDstMZ98Hh/1CPBqorYohdOLXZS sdU/QwzvuibcBszAA2285OEhPFZ7q3noQ5ZNFFLEedvJHmdMHZYl9qj+iLdzTMJhEY 2qqYiXZlzJ7+h3IZk2f4zz9qKFjiIHMZqvBIwc2g= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-93048: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() Date: Thu, 17 Sep 2026 17:15:27 +0100 Message-ID: <2026091734-CVE-2026-93048-488c@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4906; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=gEcc7jtmCJGRgLkBg9GZRu+liGrLekzogA877HDf/FM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBPbJxov0T3oi99xQxINnwbPIGT/FM0pfsvJN+bnrb PHhrAdfO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiUlsYFszqd6zPiZ9x4smf 6hC3ZX5/ZWe5ijHMYjrJ3D5t2ZtKw10+z/Web1j7Od7/IQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd_add_partition() does not reject the special offset value MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value depends on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior. Commit 5daa7b21496a ("mtd: prepare partition add and del functions for ioctl requests") introduced mtd_add_partition() and correctly rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2), since those special offsets rely on cur_offset tracking the previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them") later added MTDPART_OFS_RETAIN (-3) for the static partition table path without updating mtd_add_partition() to also reject this value. With offset=-3 passed via BLKPG, the RETAIN size calculation in allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD = parent_size + 3). If the underflow result does not appear to leave enough space, allocate_partition() jumps to out_register via goto, skipping erasesize initialization. This results in erasesize=0, which triggers: WARN_ON((!mtd->erasesize || !master->_erase) && !(mtd->flags & MTD_NO_ERASE)) in add_mtd_device(). If the underflow result appears to leave enough space, a bogus partition size is calculated, but the "out of reach" sanity check catches the invalid offset and creates a disabled empty partition (offset=0, size=0) instead of returning an error. Fix this by adding MTDPART_OFS_RETAIN to the rejection list in mtd_add_partition(), consistent with the existing handling of APPEND and NXTBLK. The Linux kernel CVE team has assigned CVE-2026-93048 to this issue. Affected and fixed versions =========================== Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 5.10.270 with commit 701c3ae7273e1adc20db5d97c42e0139b479f16b Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 5.15.221 with commit 6aaab2ace3f7b55733d904e5549acf8405f03642 Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.1.188 with commit 181c1bff940e7d3e34ca485d37e3cdbfe409203c Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.6.157 with commit a536eb57be58442b19398b2783071007ecfb1735 Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.12.110 with commit e204e5c49a012f99638633fdbd773e3c86260053 Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 6.18.52 with commit 398aca2f90122d5abbabff1079deaeb885fe9e40 Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 7.2.6 with commit c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff Issue introduced in 3.2 with commit 1a31368bf92ef2a7da3ba379672c405bd2751df9 and fixed in 7.3-rc1 with commit b759d5bb6265419344ee9729fd0dc07ad85719d8 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-93048 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/mtd/mtdpart.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/701c3ae7273e1adc20db5d97c42e0139b479f16b https://git.kernel.org/stable/c/6aaab2ace3f7b55733d904e5549acf8405f03642 https://git.kernel.org/stable/c/181c1bff940e7d3e34ca485d37e3cdbfe409203c https://git.kernel.org/stable/c/a536eb57be58442b19398b2783071007ecfb1735 https://git.kernel.org/stable/c/e204e5c49a012f99638633fdbd773e3c86260053 https://git.kernel.org/stable/c/398aca2f90122d5abbabff1079deaeb885fe9e40 https://git.kernel.org/stable/c/c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff https://git.kernel.org/stable/c/b759d5bb6265419344ee9729fd0dc07ad85719d8