CVE-2026-46285: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46285 Overview

CVE-2026-46285 is a use-after-free vulnerability in the Linux kernel's mtd/docg3 driver. The flaw resides in the docg3_release() function, where the docg3 pointer is obtained from cascade->floors[0]->priv before a loop that invokes doc_release_device() on each floor. Because doc_release_device() frees the docg3 struct via kfree(docg3), subsequent access to docg3->cascade->bch dereferences memory that has already been released.

The issue affects systems using the Disk-On-Chip G3 memory technology device driver. Kernel maintainers have committed fixes across multiple stable branches.

Critical Impact
Use-after-free conditions in kernel drivers can lead to memory corruption, kernel panics, or potential local privilege escalation when conditions allow attacker-controlled reuse of freed memory.

Affected Products

Linux kernel mtd/docg3 driver
Multiple stable Linux kernel branches receiving backported fixes
Systems with Disk-On-Chip G3 flash storage device support enabled

Discovery Timeline

2026-06-08 - CVE-2026-46285 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46285

Vulnerability Analysis

The vulnerability is a classic use-after-free (UAF) condition in the docg3_release() cleanup path of the mtd/docg3 driver. The function caches a pointer to the docg3 structure from cascade->floors[0]->priv into a local variable. It then iterates through each floor, calling doc_release_device(), which internally executes kfree(docg3) at line 1881 of the driver source.

After the loop completes, the code references docg3->cascade->bch. The docg3 allocation has already been freed by the first iteration of the release loop. The dereference therefore reads from deallocated kernel heap memory.

Root Cause

The root cause is improper lifetime management of the cached docg3 pointer. The driver author assumed the pointer remained valid for the duration of docg3_release(), but the cleanup loop that calls doc_release_device() releases the same allocation referenced by the cached pointer. The fix accesses cascade->bch directly, since cascade is already available as a local variable and docg3->cascade points back to the same cascade structure.

Attack Vector

The code path is invoked during driver release, typically on module unload or device teardown. Triggering the unsafe dereference requires reaching the docg3_release() cleanup routine on hardware that exposes the docg3 driver. Exploitation generally requires local access and the ability to influence driver lifecycle events. The vulnerability does not present a remote network attack surface.

The vulnerability is described in prose only. See the upstream commits including Kernel Git Commit 16f6588 and Kernel Git Commit 2bf706f for the corrected code.

Detection Methods for CVE-2026-46285

Indicators of Compromise

Kernel panics or oops messages referencing docg3_release or doc_release_device in dmesg
KASAN reports flagging use-after-free in the mtd/docg3 subsystem
Unexpected memory corruption symptoms after mtd driver unload events

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and development builds to surface the UAF at runtime
Audit kernel build configurations to identify hosts compiling CONFIG_MTD_DOCG3
Compare running kernel versions against the patched commits referenced in the kernel.org stable tree

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform for kernel oops and KASAN signatures
Track kernel package versions across the fleet to identify hosts running pre-patch builds
Monitor module load and unload events for the docg3 driver via auditd

How to Mitigate CVE-2026-46285

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that incorporates the upstream fix
On systems that do not require Disk-On-Chip G3 hardware support, blacklist or unload the docg3 module
Restrict local user access and module loading privileges to reduce exposure to driver-lifecycle code paths

Patch Information

The fix removes the stale docg3 local variable and accesses cascade->bch directly. It is included in the following upstream commits: Kernel Git Commit 16f6588, Kernel Git Commit 2bf706f, Kernel Git Commit 8408655, Kernel Git Commit ca19808, Kernel Git Commit d26f8c3, Kernel Git Commit d49628d, Kernel Git Commit d890448, and Kernel Git Commit f5d2ed4.

Workarounds

Blacklist the docg3 kernel module on systems without Disk-On-Chip G3 hardware
Prevent the module from auto-loading by adding an entry to /etc/modprobe.d/
Limit kernel module loading to privileged administrators via kernel.modules_disabled once required modules are loaded

bash

# Blacklist the docg3 module to prevent loading
echo "blacklist docg3" | sudo tee /etc/modprobe.d/blacklist-docg3.conf
sudo depmod -a

# Verify the module is not currently loaded
lsmod | grep docg3

# Optionally lock further module loading after boot
sudo sysctl -w kernel.modules_disabled=1