CVE-2026-98855

of/overlay: put property on deadprops only after changeset add succeeds

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: put property on deadprops only after changeset add succeeds

add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of_changeset_add_property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of_node_release() frees it a second time when the aborted overlay's node is released.

Record the changeset entry first and link the property into deadprops only on success. of_changeset_add_property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f96278810150fc39085d1872e5b39ea06366d03e to before 004a0ee2e5315f1245775b369fcb940e8cda3807Affected f96278810150fc39085d1872e5b39ea06366d03e to before f6f70b12ae3e4074e4cd3f42cd66fd482ce7a4b5Affected f96278810150fc39085d1872e5b39ea06366d03e to before 50c3663790c61648a51f197970f660fd543269a7Affected f96278810150fc39085d1872e5b39ea06366d03e to before 936f1ffcb87a1c50938a21176a6463af162cf4b5Affected f96278810150fc39085d1872e5b39ea06366d03e to before d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3aAffected f96278810150fc39085d1872e5b39ea06366d03e to before 7dc6a769153c0457077a0da4888a00f61e66de15Affected f96278810150fc39085d1872e5b39ea06366d03e to before 5857035a3b53a4e7b5a0d5a740189901ece0b079Affected f96278810150fc39085d1872e5b39ea06366d03e to before 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9cAffected b52ca352489be8beb7de3a8181509a0deaf72e21Affected 4.19.49 to before 4.20Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f96278810150fc39085d1872e5b39ea06366d03e to before 004a0ee2e5315f1245775b369fcb940e8cda3807Affected
f96278810150fc39085d1872e5b39ea06366d03e to before f6f70b12ae3e4074e4cd3f42cd66fd482ce7a4b5Affected
f96278810150fc39085d1872e5b39ea06366d03e to before 50c3663790c61648a51f197970f660fd543269a7Affected
f96278810150fc39085d1872e5b39ea06366d03e to before 936f1ffcb87a1c50938a21176a6463af162cf4b5Affected
f96278810150fc39085d1872e5b39ea06366d03e to before d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3aAffected
f96278810150fc39085d1872e5b39ea06366d03e to before 7dc6a769153c0457077a0da4888a00f61e66de15Affected
f96278810150fc39085d1872e5b39ea06366d03e to before 5857035a3b53a4e7b5a0d5a740189901ece0b079Affected
f96278810150fc39085d1872e5b39ea06366d03e to before 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9cAffected
b52ca352489be8beb7de3a8181509a0deaf72e21Affected
4.19.49 to before 4.20Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.