All vulnerabilities
CVE-2026-98854

Linux: of/overlay: only treat a positive changeset id as registered

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0d1525fdcd3355672b7485d61e55df6824ab5ad1Also 44081d708b5b885487bac792db78324b7b4c267dCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0d1525fdcd3355672b7485d61e55df6824ab5ad1LinuxCVE List
  • 44081d708b5b885487bac792db78324b7b4c267dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: only treat a positive changeset id as registered

of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL.

Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.

Text from CVE List

Affected versions 12

  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before cc688475c56d34a2b584141f9544cbe23360080dCVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before c08a54df9d33dcd6ff089adc9434b2c008af3a39CVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 0d1525fdcd3355672b7485d61e55df6824ab5ad1CVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before c875407c34dadaef0599834ad9c815f4c9f50d15CVE List
  • Linuxaffected: 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 44081d708b5b885487bac792db78324b7b4c267dCVE List
  • Linuxaffected: 4.15CVE List
  • Linuxunaffected: all versions before 4.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5