CVE-2026-98854
Received
Received - Intake
Use-After-Free in Linux Kernel of OverlayFS
Vulnerability report for CVE-2026-98854, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: only treat a positive changeset id as registered
of_overlay_fdt_apply() stores the idr_alloc() return value in
ovcs->id before checking it. On failure the stored id is negative,
free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove()
is called with a negative id and list_del() runs on ovcs->ovcs_list,
which is not initialized until after the id allocation. An allocation
failure at that point dereferences NULL.
Make free_overlay_changeset() treat only a strict-positive id as
registered. The rest of the function already copes with a
partially-initialized ovcs, so the error path stays a plain
goto err_free_ovcs.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 61b4de4e0b384f4a22c55c3bada604da49cec4e1 |
| Linux | Linux | 61b4de4e0b384f4a22c55c3bada604da49cec4e1 |
| Linux | Linux | 61b4de4e0b384f4a22c55c3bada604da49cec4e1 |
| Linux | Linux | 61b4de4e0b384f4a22c55c3bada604da49cec4e1 |
| Linux | Linux | 4.15 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
