CVE-2026-68424

A flaw was found in the Linux kernel's mtd_virt_concat module. This use-after-free vulnerability occurs when the mtd_concat_destroy() function frees memory before it is no longer referenced by mtd_virt_concat_put_mtd_devices(). An attacker could potentially exploit this flaw to cause memory corruption, which may lead to a denial of service or other impacts on system stability.

This issue affects virtual MTD concat join devices. Same UAF pattern as CVE-2026-68423 in destroy_joins path. Systems not using virt_concat MTD are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.