CVE-2026-98854

of/overlay: only treat a positive changeset id as registered

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: only treat a positive changeset id as registered

of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL.

Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 7af5d66d0514b8f1d759d0e32b9d4c5d26263e4aAffected 61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 71065f3d6864a101b77e7af84566757c4df415a0Affected 61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before cc688475c56d34a2b584141f9544cbe23360080dAffected 61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before c08a54df9d33dcd6ff089adc9434b2c008af3a39Affected 61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 0d1525fdcd3355672b7485d61e55df6824ab5ad1Affected 61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before c875407c34dadaef0599834ad9c815f4c9f50d15Affected 61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 44081d708b5b885487bac792db78324b7b4c267dAffected
LinuxLinux	4.15Affected before 4.15Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 7af5d66d0514b8f1d759d0e32b9d4c5d26263e4aAffected
61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 71065f3d6864a101b77e7af84566757c4df415a0Affected
61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before cc688475c56d34a2b584141f9544cbe23360080dAffected
61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before c08a54df9d33dcd6ff089adc9434b2c008af3a39Affected
61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 0d1525fdcd3355672b7485d61e55df6824ab5ad1Affected
61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before c875407c34dadaef0599834ad9c815f4c9f50d15Affected
61b4de4e0b384f4a22c55c3bada604da49cec4e1 to before 44081d708b5b885487bac792db78324b7b4c267dAffected

LinuxLinux

4.15Affected
before 4.15Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.