CVE-2026-98854of/overlay: only treat a positive changeset id as registered
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL. Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before c08a54df9d33dcd6ff089adc9434b2c008af3a39; 61b4de4e0b384f4a22c55c3bada604da49cec4e1 builds before 0d1525fdcd3355672b7485d61e55df6824ab5ad1; from 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before c875407c34dadaef0599834ad9c815f4c9f50d15; from 61b4de4e0b384f4a22c55c3bada604da49cec4e1 before 44081d708b5b885487bac792db78324b7b4c267d | CNA record |
References
- https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39
- https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1
- https://git.kernel.org/stable/c/c875407c34dadaef0599834ad9c815f4c9f50d15
- https://git.kernel.org/stable/c/44081d708b5b885487bac792db78324b7b4c267d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.