CVE-2026-45921 Overview
CVE-2026-45921 is a memory leak vulnerability in the Linux kernel's Memory Technology Device (MTD) subsystem. The flaw resides in the mtd_parser_tplink_safeloader_parse() function used to parse TP-Link Safeloader partition tables. When the kernel fails to allocate memory for parts[idx].name inside the partition iteration loop, execution jumps to the err_free label without releasing the temporary buffer buf allocated by mtd_parser_tplink_safeloader_read_table(). Repeated parsing failures can exhaust kernel memory over time. The issue was identified through prototype static analysis tooling and code review, and resolved across multiple stable kernel branches.
Critical Impact
Repeated triggering of the failure path leaks kernel heap memory, contributing to resource exhaustion on long-running systems that mount affected MTD partitions.
Affected Products
- Linux kernel — drivers/mtd/parsers/tplink_safeloader.c
- Devices using TP-Link Safeloader-formatted flash layouts parsed by the MTD subsystem
- Embedded and router platforms shipping kernels prior to the upstream fix commits
Discovery Timeline
- 2026-05-27 - CVE-2026-45921 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45921
Vulnerability Analysis
The vulnerability is a classic kernel memory leak in an error-handling path. The MTD parser allocates a temporary buffer through mtd_parser_tplink_safeloader_read_table() and then iterates through partition entries, allocating a name string for each partition via kstrdup or equivalent. If a name allocation fails for any partition index, control transfers to the err_free cleanup label, which releases previously allocated partition names but does not release the buf buffer that holds the raw partition table data. Each invocation that reaches the failure branch leaves the buffer orphaned in kernel heap memory.
Root Cause
The root cause is an incomplete cleanup sequence at the err_free label. The cleanup logic was written before buf was added as a separate allocation, and the maintainer did not extend the unwind path to free it. The fix adds a kfree(buf) call to the err_free label so all resources allocated during parsing are released on every error exit.
Attack Vector
Local triggering requires the ability to cause repeated parsing failures of TP-Link Safeloader partition tables, typically by attaching crafted flash images or by inducing allocation failures during MTD probe operations. The vulnerability does not provide code execution or privilege escalation. The impact is bounded to kernel memory exhaustion and potential denial of service on devices where the parser runs repeatedly.
No verified exploit code is available. See the upstream commits for the precise patch: Linux Kernel Commit 0f5e62e, Linux Kernel Commit 971e9c5, Linux Kernel Commit 980ce2b, Linux Kernel Commit e97f5fa, and Linux Kernel Commit ec121ad.
Detection Methods for CVE-2026-45921
Indicators of Compromise
- Gradual growth of unaccounted kernel slab memory on devices that repeatedly probe MTD partitions.
- kmalloc-* slab usage increasing without correlated process memory growth in /proc/slabinfo.
- Repeated MTD parser warnings or partition allocation failures in dmesg.
Detection Strategies
- Audit installed kernel versions against the stable branches that received the upstream fix commits.
- Track kmemleak reports referencing allocations originating from mtd_parser_tplink_safeloader_read_table on test systems with CONFIG_DEBUG_KMEMLEAK=y.
- Correlate device uptime with kernel slab growth on fleet inventories of embedded Linux endpoints.
Monitoring Recommendations
- Collect dmesg output and slab statistics from embedded Linux devices and route them to a centralized log store for trend analysis.
- Alert on sustained growth of kernel slab memory that does not correspond to user-space workload changes.
- Track vendor firmware advisories for routers and IoT devices that ship kernels with the TP-Link Safeloader MTD parser enabled.
How to Mitigate CVE-2026-45921
Immediate Actions Required
- Update to a Linux kernel version that includes the upstream fix referenced in the stable commits listed above.
- Rebuild and redeploy custom kernels for embedded products that enable CONFIG_MTD_TPLINK_PARTS or equivalent.
- Inventory router and IoT device firmware images using the TP-Link Safeloader format and prioritize patching long-running devices.
Patch Information
The fix adds a kfree(buf) call to the err_free label inside mtd_parser_tplink_safeloader_parse() so the temporary buffer allocated by mtd_parser_tplink_safeloader_read_table() is released on every error exit. The change has been backported across multiple stable branches via commits 0f5e62e, 971e9c5, 980ce2b, e97f5fa, and ec121ad.
Workarounds
- Disable the TP-Link Safeloader parser in kernel configuration when the platform does not require it by unsetting the relevant CONFIG_MTD_* option and rebuilding the kernel.
- Reboot long-running affected devices on a scheduled basis to reclaim leaked kernel memory until patches can be deployed.
- Restrict the ability to load arbitrary MTD images or trigger parser re-execution to administrative contexts only.
# Verify the running kernel and MTD parser configuration
uname -r
zcat /proc/config.gz 2>/dev/null | grep -i tplink
grep -i tplink /boot/config-$(uname -r) 2>/dev/null
# Inspect MTD partitions and slab usage for leak symptoms
cat /proc/mtd
grep -E 'kmalloc|kmemleak' /proc/slabinfo
dmesg | grep -i 'mtd\|tplink'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
