{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98831", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.372Z", "datePublished": "2026-10-18T15:49:32.909Z", "dateUpdated": "2026-10-30T12:40:03.420Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:03.420Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: don't leak fragment references when changeset init fails\n\ninit_overlay_changeset() stores the number of initialized fragments\nin ovcs->count only on full success. When find_target() or the\n__symbols__ lookup fails partway through, the target and overlay\nreferences taken for the fragments initialized so far are never\ndropped: free_overlay_changeset() bounds its cleanup loop by\novcs->count, which is still 0.\n\nStore the running count on the error path so free_overlay_changeset()\nputs whatever was set up. The store is guarded by ovcs->fragments\nbecause on the allocation-failure path cnt still holds the counting\npass total while there is no fragments array; everywhere else cnt\nonly counts fully-initialized fragments."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/of/overlay.c"], "versions": [{"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "c654f283d7db20648a5bbf979209f78d4fa9be3f", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "64517aeaa3d8b158e4d01321a095be48cb551251", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "702b5db6e7b3865be70675d57d6fd7dde80d02b6", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "894573e2fdaeb1b15030b7eebc22615edf28a6cd", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "7a46f1917b320cc8762183b802301da02a191b6a", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "3a23fb158ba517b77a2e5258263bdfdaa480f758", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "1d62f0f2bc7edb12ed09f71203df0e47fa4efca4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/of/overlay.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c654f283d7db20648a5bbf979209f78d4fa9be3f"}, {"url": "https://git.kernel.org/stable/c/64517aeaa3d8b158e4d01321a095be48cb551251"}, {"url": "https://git.kernel.org/stable/c/bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80"}, {"url": "https://git.kernel.org/stable/c/702b5db6e7b3865be70675d57d6fd7dde80d02b6"}, {"url": "https://git.kernel.org/stable/c/894573e2fdaeb1b15030b7eebc22615edf28a6cd"}, {"url": "https://git.kernel.org/stable/c/7a46f1917b320cc8762183b802301da02a191b6a"}, {"url": "https://git.kernel.org/stable/c/3a23fb158ba517b77a2e5258263bdfdaa480f758"}, {"url": "https://git.kernel.org/stable/c/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4"}], "title": "of/overlay: don't leak fragment references when changeset init fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/of/overlay.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c654f283d7db20648a5bbf979209f78d4fa9be3f", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "64517aeaa3d8b158e4d01321a095be48cb551251", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "702b5db6e7b3865be70675d57d6fd7dde80d02b6", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "894573e2fdaeb1b15030b7eebc22615edf28a6cd", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "7a46f1917b320cc8762183b802301da02a191b6a", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "3a23fb158ba517b77a2e5258263bdfdaa480f758", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "1d62f0f2bc7edb12ed09f71203df0e47fa4efca4", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/of/overlay.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: don't leak fragment references when changeset init fails\n\ninit_overlay_changeset() stores the number of initialized fragments\nin ovcs->count only on full success. When find_target() or the\n__symbols__ lookup fails partway through, the target and overlay\nreferences taken for the fragments initialized so far are never\ndropped: free_overlay_changeset() bounds its cleanup loop by\novcs->count, which is still 0.\n\nStore the running count on the error path so free_overlay_changeset()\nputs whatever was set up. The store is guarded by ovcs->fragments\nbecause on the allocation-failure path cnt still holds the counting\npass total while there is no fragments array; everywhere else cnt\nonly counts fully-initialized fragments."}], "id": "CVE-2026-98831", "lastModified": "2026-10-30T13:21:29.530", "metrics": {}, "published": "2026-10-18T16:17:37.347", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a23fb158ba517b77a2e5258263bdfdaa480f758"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64517aeaa3d8b158e4d01321a095be48cb551251"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/702b5db6e7b3865be70675d57d6fd7dde80d02b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a46f1917b320cc8762183b802301da02a191b6a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/894573e2fdaeb1b15030b7eebc22615edf28a6cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c654f283d7db20648a5bbf979209f78d4fa9be3f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: of/overlay: don't leak fragment references when changeset init fails", "id": "2555223", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555223"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's Device Tree overlay subsystem. This flaw allows a local user to cause a Denial of Service (DoS) through memory exhaustion. When an overlay changeset fails during target or symbol lookup, the kernel fails to release previously acquired fragment references during error cleanup. By repeatedly triggering this initialization failure, an attacker can leak kernel memory over time."], "name": "CVE-2026-98831", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98831\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98831\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98831.mbox"], "threat_severity": "Low"}