CVE-2026-98831
In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0. Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
Affected versions
Linux kernel versions
4.15
and later are affected. Fixed in
6.12.113,
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98831?
CVE-2026-98831 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.15 onward and has been patched in 6.12.113, 6.18.56, 7.2.10 and others. CVE-2026-98831 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98831?
Yes. CVE-2026-98831 has been patched. Fixed versions include 6.12.113, 6.18.56, 7.2.10 and others. If you are running Linux kernel 4.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98831 actively exploited?
No. CVE-2026-98831 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.