CVE-2026-98831
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0. Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-18 16:17:37.347000
Last modified
2026-10-30 13:21:29.530000
View original CVE JSON
{
"id": "CVE-2026-98831",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-18T16:17:37.347",
"lastModified": "2026-10-30T13:21:29.530",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: don't leak fragment references when changeset init fails\n\ninit_overlay_changeset() stores the number of initialized fragments\nin ovcs->count only on full success. When find_target() or the\n__symbols__ lookup fails partway through, the target and overlay\nreferences taken for the fragments initialized so far are never\ndropped: free_overlay_changeset() bounds its cleanup loop by\novcs->count, which is still 0.\n\nStore the running count on the error path so free_overlay_changeset()\nputs whatever was set up. The store is guarded by ovcs->fragments\nbecause on the allocation-failure path cnt still holds the counting\npass total while there is no fragments array; everywhere else cnt\nonly counts fully-initialized fragments."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/of/overlay.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "c654f283d7db20648a5bbf979209f78d4fa9be3f",
"versionType": "git",
"status": "affected"
},
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "64517aeaa3d8b158e4d01321a095be48cb551251",
"versionType": "git",
"status": "affected"
},
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80",
"versionType": "git",
"status": "affected"
},
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "702b5db6e7b3865be70675d57d6fd7dde80d02b6",
"versionType": "git",
"status": "affected"
},
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "894573e2fdaeb1b15030b7eebc22615edf28a6cd",
"versionType": "git",
"status": "affected"
},
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "7a46f1917b320cc8762183b802301da02a191b6a",
"versionType": "git",
"status": "affected"
},
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "3a23fb158ba517b77a2e5258263bdfdaa480f758",
"versionType": "git",
"status": "affected"
},
{
"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1",
"lessThan": "1d62f0f2bc7edb12ed09f71203df0e47fa4efca4",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/of/overlay.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.15",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.113",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.56",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.10",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3a23fb158ba517b77a2e5258263bdfdaa480f758",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/64517aeaa3d8b158e4d01321a095be48cb551251",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/702b5db6e7b3865be70675d57d6fd7dde80d02b6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7a46f1917b320cc8762183b802301da02a191b6a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/894573e2fdaeb1b15030b7eebc22615edf28a6cd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c654f283d7db20648a5bbf979209f78d4fa9be3f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}