All vulnerabilities
CVE-2026-98855

Linux: of/overlay: put property on deadprops only after changeset add succeeds

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in936f1ffcb87a1c50938a21176a6463af162cf4b5Also 7dc6a769153c0457077a0da4888a00f61e66de15, 5857035a3b53a4e7b5a0d5a740189901ece0b079 and 2 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 936f1ffcb87a1c50938a21176a6463af162cf4b5LinuxCVE List
  • 7dc6a769153c0457077a0da4888a00f61e66de15LinuxCVE List
  • 5857035a3b53a4e7b5a0d5a740189901ece0b079LinuxCVE List
  • 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9cLinuxCVE List
  • 4.20LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: put property on deadprops only after changeset add succeeds

add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of_changeset_add_property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of_node_release() frees it a second time when the aborted overlay's node is released.

Record the changeset entry first and link the property into deadprops only on success. of_changeset_add_property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.

Text from CVE List

Affected versions 14

  • Linuxaffected: f96278810150fc39085d1872e5b39ea06366d03e before 936f1ffcb87a1c50938a21176a6463af162cf4b5CVE List
  • Linuxaffected: f96278810150fc39085d1872e5b39ea06366d03e before d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3aCVE List
  • Linuxaffected: f96278810150fc39085d1872e5b39ea06366d03e before 7dc6a769153c0457077a0da4888a00f61e66de15CVE List
  • Linuxaffected: f96278810150fc39085d1872e5b39ea06366d03e before 5857035a3b53a4e7b5a0d5a740189901ece0b079CVE List
  • Linuxaffected: f96278810150fc39085d1872e5b39ea06366d03e before 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9cCVE List
  • Linuxaffected: b52ca352489be8beb7de3a8181509a0deaf72e21CVE List
  • Linuxaffected: 4.19.49 before 4.20CVE List
  • Linuxaffected: 5.0CVE List
  • Linuxunaffected: all versions before 5.0CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5