All vulnerabilities
CVE-2026-98831

Linux: of/overlay: don't leak fragment references when changeset init fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in702b5db6e7b3865be70675d57d6fd7dde80d02b6Also 894573e2fdaeb1b15030b7eebc22615edf28a6cd, 7a46f1917b320cc8762183b802301da02a191b6a and 2 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 702b5db6e7b3865be70675d57d6fd7dde80d02b6LinuxCVE List
  • 894573e2fdaeb1b15030b7eebc22615edf28a6cdLinuxCVE List
  • 7a46f1917b320cc8762183b802301da02a191b6aLinuxCVE List
  • 3a23fb158ba517b77a2e5258263bdfdaa480f758LinuxCVE List
  • 1d62f0f2bc7edb12ed09f71203df0e47fa4efca4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: don't leak fragment references when changeset init fails

init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0.

Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.

Text from CVE List

Affected versions 12

  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 702b5db6e7b3865be70675d57d6fd7dde80d02b6CVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 894573e2fdaeb1b15030b7eebc22615edf28a6cdCVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 7a46f1917b320cc8762183b802301da02a191b6aCVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 3a23fb158ba517b77a2e5258263bdfdaa480f758CVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 1d62f0f2bc7edb12ed09f71203df0e47fa4efca4CVE List
  • Linuxaffected: 4.15CVE List
  • Linuxunaffected: all versions before 4.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5