{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98854", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.376Z", "datePublished": "2026-10-18T15:51:06.167Z", "dateUpdated": "2026-10-30T12:40:15.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:15.237Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: only treat a positive changeset id as registered\n\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs->id before checking it. On failure the stored id is negative,\nfree_overlay_changeset()'s \"if (ovcs->id)\" check passes, idr_remove()\nis called with a negative id and list_del() runs on ovcs->ovcs_list,\nwhich is not initialized until after the id allocation. An allocation\nfailure at that point dereferences NULL.\n\nMake free_overlay_changeset() treat only a strict-positive id as\nregistered. The rest of the function already copes with a\npartially-initialized ovcs, so the error path stays a plain\ngoto err_free_ovcs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/of/overlay.c"], "versions": [{"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "7af5d66d0514b8f1d759d0e32b9d4c5d26263e4a", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "71065f3d6864a101b77e7af84566757c4df415a0", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "cc688475c56d34a2b584141f9544cbe23360080d", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "c08a54df9d33dcd6ff089adc9434b2c008af3a39", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "0d1525fdcd3355672b7485d61e55df6824ab5ad1", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "c875407c34dadaef0599834ad9c815f4c9f50d15", "status": "affected", "versionType": "git"}, {"version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "lessThan": "44081d708b5b885487bac792db78324b7b4c267d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/of/overlay.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7af5d66d0514b8f1d759d0e32b9d4c5d26263e4a"}, {"url": "https://git.kernel.org/stable/c/71065f3d6864a101b77e7af84566757c4df415a0"}, {"url": "https://git.kernel.org/stable/c/cc688475c56d34a2b584141f9544cbe23360080d"}, {"url": "https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39"}, {"url": "https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1"}, {"url": "https://git.kernel.org/stable/c/c875407c34dadaef0599834ad9c815f4c9f50d15"}, {"url": "https://git.kernel.org/stable/c/44081d708b5b885487bac792db78324b7b4c267d"}], "title": "of/overlay: only treat a positive changeset id as registered", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/of/overlay.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7af5d66d0514b8f1d759d0e32b9d4c5d26263e4a", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "71065f3d6864a101b77e7af84566757c4df415a0", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "cc688475c56d34a2b584141f9544cbe23360080d", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "c08a54df9d33dcd6ff089adc9434b2c008af3a39", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "0d1525fdcd3355672b7485d61e55df6824ab5ad1", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "c875407c34dadaef0599834ad9c815f4c9f50d15", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}, {"lessThan": "44081d708b5b885487bac792db78324b7b4c267d", "status": "affected", "version": "61b4de4e0b384f4a22c55c3bada604da49cec4e1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/of/overlay.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: only treat a positive changeset id as registered\n\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs->id before checking it. On failure the stored id is negative,\nfree_overlay_changeset()'s \"if (ovcs->id)\" check passes, idr_remove()\nis called with a negative id and list_del() runs on ovcs->ovcs_list,\nwhich is not initialized until after the id allocation. An allocation\nfailure at that point dereferences NULL.\n\nMake free_overlay_changeset() treat only a strict-positive id as\nregistered. The rest of the function already copes with a\npartially-initialized ovcs, so the error path stays a plain\ngoto err_free_ovcs."}], "id": "CVE-2026-98854", "lastModified": "2026-10-30T13:21:30.980", "metrics": {}, "published": "2026-10-18T16:17:39.833", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/44081d708b5b885487bac792db78324b7b4c267d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71065f3d6864a101b77e7af84566757c4df415a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7af5d66d0514b8f1d759d0e32b9d4c5d26263e4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c875407c34dadaef0599834ad9c815f4c9f50d15"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc688475c56d34a2b584141f9544cbe23360080d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: of/overlay: only treat a positive changeset id as registered", "id": "2555233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555233"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nof/overlay: only treat a positive changeset id as registered\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs->id before checking it. On failure the stored id is negative,\nfree_overlay_changeset()'s \"if (ovcs->id)\" check passes, idr_remove()\nis called with a negative id and list_del() runs on ovcs->ovcs_list,\nwhich is not initialized until after the id allocation. An allocation\nfailure at that point dereferences NULL.\nMake free_overlay_changeset() treat only a strict-positive id as\nregistered. The rest of the function already copes with a\npartially-initialized ovcs, so the error path stays a plain\ngoto err_free_ovcs.", "A flaw was found in the Linux kernel's Device Tree overlay subsystem. When applying an overlay fails during identifier allocation, the error cleanup routine incorrectly treats negative error codes as valid identifiers. A local user could trigger this vulnerability during resource allocation failures, causing an uninitialized list operation and a null pointer dereference that crashes the kernel, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98854", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98854\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98854\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98854.mbox"], "threat_severity": "Moderate"}