CVE-2026-98831of/overlay: don't leak fragment references when changeset init fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0. Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 894573e2fdaeb1b15030b7eebc22615edf28a6cd; 61b4de4e0b384f4a22c55c3bada604da49cec4e1 builds before 7a46f1917b320cc8762183b802301da02a191b6a; 61b4de4e0b384f4a22c55c3bada604da49cec4e1 builds before 3a23fb158ba517b77a2e5258263bdfdaa480f758; 61b4de4e0b384f4a22c55c3bada604da49cec4e1 builds before 1d62f0f2bc7edb12ed09f71203df0e47fa4efca4 | CNA record |
References
- https://git.kernel.org/stable/c/894573e2fdaeb1b15030b7eebc22615edf28a6cd
- https://git.kernel.org/stable/c/7a46f1917b320cc8762183b802301da02a191b6a
- https://git.kernel.org/stable/c/3a23fb158ba517b77a2e5258263bdfdaa480f758
- https://git.kernel.org/stable/c/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.