CVE-2026-98854

Received Received - Intake

Use-After-Free in Linux Kernel of OverlayFS

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL. Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98854

EUVD

EUVD-2026-103794

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	61b4de4e0b384f4a22c55c3bada604da49cec4e1
Linux	Linux	61b4de4e0b384f4a22c55c3bada604da49cec4e1
Linux	Linux	61b4de4e0b384f4a22c55c3bada604da49cec4e1
Linux	Linux	61b4de4e0b384f4a22c55c3bada604da49cec4e1
Linux	Linux	4.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of changeset IDs in the overlay filesystem. A negative ID from a failed allocation is stored and later treated as valid, causing a NULL pointer dereference when cleanup functions attempt to free uninitialized resources.

Detection Guidance

This vulnerability is specific to the Linux kernel's overlay filesystem functionality. Detection requires checking kernel logs for overlay-related errors or examining kernel source code for the affected function. No direct network detection commands are applicable. Inspect kernel logs with 'dmesg | grep overlay' or check kernel version with 'uname -r'.

Impact Analysis

This could lead to kernel crashes or denial-of-service conditions if exploited. Systems using Linux kernel overlays may become unstable or require rebooting to recover from the failure.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue that could lead to system instability or crashes but does not involve data exposure or unauthorized access that would typically impact regulatory compliance.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this vulnerability. If immediate patching is not possible, disable overlayfs functionality by adding 'overlay' to the module blacklist in /etc/modprobe.d/ or unmounting any active overlay mounts.

Hi! I’m here to help you understand CVE-2026-98854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70