CVE-2026-98833

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

mtd: core: call _get_device() with the master MTD

__get_mtd_device() calls the master’s _get_device() callback with mtd, which may be a partition. __put_mtd_device() passes the master.

This breaks gluebi partitions because gluebi_get_device() uses container_of() and therefore requires the master MTD. Pass the master to _get_device(), matching _put_device().

Affected product:

AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Debian 11 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU

Affected packages:

linux @ 5.10.259 (+4 more)