In the Linux kernel, the following vulnerability has been resolved: mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd_add_partition() does not reject the special offset value MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in add_mtd_device() when called through the BLKPG ioctl on NAND devices. The RETAIN value depends on cur_offset being the end of the previous partition, but in the dynamic partition path cur_offset equals the offset argument itself, causing undefined behavior. Commit 5daa7b21496a ("mtd: prepare partition add and del functions for ioctl requests") introduced mtd_add_partition() and correctly rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2), since those special offsets rely on cur_offset tracking the previous partition's end. However, commit 1a31368bf92e ("mtd: add a flags for partitions which should just leave smth. after them") later added MTDPART_OFS_RETAIN (-3) for the static partition table path without updating mtd_add_partition() to also reject this value. With offset=-3 passed via BLKPG, the RETAIN size calculation in allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD = parent_size + 3). If the underflow result does not appear to leave enough space, allocate_partition() jumps to out_register via goto, skipping erasesize initialization. This results in erasesize=0, which triggers: WARN_ON((!mtd->erasesize || !master->_erase) && !(mtd->flags & MTD_NO_ERASE)) in add_mtd_device(). If the underflow result appears to leave enough space, a bogus partition size is calculated, but the "out of reach" sanity check catches the invalid offset and creates a disabled empty partition (offset=0, size=0) instead of returning an error. Fix this by adding MTDPART_OFS_RETAIN to the rejection list in mtd_add_partition(), consistent with the existing handling of APPEND and NXTBLK.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd_add_partition() does not reject the     special offset value MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in add_mtd_device() when called     through the BLKPG ioctl on NAND devices. The RETAIN value depends on cur_offset being the end of the     previous partition, but in the dynamic partition path cur_offset equals the offset argument itself,     causing undefined behavior. Commit 5daa7b21496a (mtd: prepare partition add and del functions for ioctl     requests) introduced mtd_add_partition() and correctly rejected MTDPART_OFS_APPEND (-1) and     MTDPART_OFS_NXTBLK (-2), since those special offsets rely on cur_offset tracking the previous partition's     end. However, commit 1a31368bf92e (mtd: add a flags for partitions which should just leave smth. after     them) later added MTDPART_OFS_RETAIN (-3) for the static partition table path without updating     mtd_add_partition() to also reject this value. With offset=-3 passed via BLKPG, the RETAIN size     calculation in allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD = parent_size + 3). If     the underflow result does not appear to leave enough space, allocate_partition() jumps to out_register via     goto, skipping erasesize initialization. This results in erasesize=0, which triggers:
    WARN_ON((!mtd->erasesize || !master->_erase) && !(mtd->flags & MTD_NO_ERASE)) in add_mtd_device(). If the     underflow result appears to leave enough space, a bogus partition size is calculated, but the out of     reach sanity check catches the invalid offset and creates a disabled empty partition (offset=0, size=0)     instead of returning an error. Fix this by adding MTDPART_OFS_RETAIN to the rejection list in     mtd_add_partition(), consistent with the existing handling of APPEND and NXTBLK. (CVE-2026-93048)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365279	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3196)	Nessus	Amazon Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347646	Linux Distros Unpatched Vulnerability : CVE-2026-93048	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-93048

medium

Tenable Plugins

medium

high

high

high

medium