diff --git a/components/nvs_flash/host_test/nvs_host_test/main/test_nvs.cpp b/components/nvs_flash/host_test/nvs_host_test/main/test_nvs.cpp
index 27222bb7b9a..1ac4710f958 100644
--- a/components/nvs_flash/host_test/nvs_host_test/main/test_nvs.cpp
+++ b/components/nvs_flash/host_test/nvs_host_test/main/test_nvs.cpp
@@ -670,6 +670,27 @@ TEST_CASE("deinit partition doesn't affect other partition's open handles", "[nv
     TEST_ESP_OK(nvs_flash_deinit_partition(OTHER_PARTITION_NAME));
 }
 
+TEST_CASE("deinit with open handles frees them", "[nvs]")
+{
+    // nvs_flash_deinit_partition must delete leftover open
+    // handles (same as nvs_close), not only erase them from the C API handle list.
+    TEST_ESP_OK(nvs_flash_erase_partition(TEST_3SEC_PARTITION_NAME));
+    TEST_ESP_OK(nvs_flash_init_partition(TEST_3SEC_PARTITION_NAME));
+
+    nvs_handle_t handle_1;
+    nvs_handle_t handle_2;
+    TEST_ESP_OK(nvs_open_from_partition(TEST_3SEC_PARTITION_NAME, "ns1", NVS_READWRITE, &handle_1));
+    TEST_ESP_OK(nvs_open_from_partition(TEST_3SEC_PARTITION_NAME, "ns2", NVS_READWRITE, &handle_2));
+    CHECK(nvs::NVSPartitionManager::get_instance()->open_handles_size() == 2);
+
+    TEST_ESP_OK(nvs_flash_deinit_partition(TEST_3SEC_PARTITION_NAME));
+    CHECK(nvs::NVSPartitionManager::get_instance()->open_handles_size() == 0);
+
+    // Stale handle ids must be harmless after deinit already freed the entries.
+    nvs_close(handle_1);
+    nvs_close(handle_2);
+}
+
 TEST_CASE("nvs iterator nvs_entry_find invalid parameter test", "[nvs]")
 {
     nvs_iterator_t it = reinterpret_cast<nvs_iterator_t>(0xbeef);
diff --git a/components/nvs_flash/include/nvs_flash.h b/components/nvs_flash/include/nvs_flash.h
index dfa187fbd7f..b6e64845225 100644
--- a/components/nvs_flash/include/nvs_flash.h
+++ b/components/nvs_flash/include/nvs_flash.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -112,6 +112,10 @@ esp_err_t nvs_flash_init_partition_ptr(const esp_partition_t *partition);
  *
  * Default NVS partition is the partition with "nvs" label in the partition table.
  *
+ * @note Prefer closing all open handles with nvs_close() before deinitializing.
+ *       Any handles still open for this partition are closed and freed here;
+ *       using them afterwards is invalid (nvs_close() on such a handle is a no-op).
+ *
  * @return
  *      - ESP_OK on success (storage was deinitialized)
  *      - ESP_ERR_NVS_NOT_INITIALIZED if the storage was not initialized prior to this call
@@ -123,6 +127,10 @@ esp_err_t nvs_flash_deinit(void);
  *
  * @param[in]  partition_label   Label of the partition
  *
+ * @note Prefer closing all open handles with nvs_close() before deinitializing.
+ *       Any handles still open for this partition are closed and freed here;
+ *       using them afterwards is invalid (nvs_close() on such a handle is a no-op).
+ *
  * @return
  *      - ESP_OK on success
  *      - ESP_ERR_NVS_NOT_INITIALIZED if the storage for given partition was not
diff --git a/components/nvs_flash/src/nvs_api.cpp b/components/nvs_flash/src/nvs_api.cpp
index effed329ddc..068a85e371c 100644
--- a/components/nvs_flash/src/nvs_api.cpp
+++ b/components/nvs_flash/src/nvs_api.cpp
@@ -82,8 +82,11 @@ static esp_err_t close_handles_and_deinit(const char* part_name)
 
     auto it = find_if(begin(s_nvs_handles), end(s_nvs_handles), belongs_to_part);
 
+    // Same as nvs_close(): unlink first, then delete. Deleting while still linked
+    // UAF-corrupts the intrusive list (hangs host tests).
     while (it != end(s_nvs_handles)) {
         s_nvs_handles.erase(it);
+        delete static_cast<NVSHandleEntry*>(it);
         it = find_if(begin(s_nvs_handles), end(s_nvs_handles), belongs_to_part);
     }