CVE-2026-98854
In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL. Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.
Affected versions
Linux kernel versions
4.15
and later are affected. Fixed in
6.12.113,
6.18.56,
7.2.10,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98854?
CVE-2026-98854 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.15 onward and has been patched in 6.12.113, 6.18.56, 7.2.10 and others. CVE-2026-98854 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98854?
Yes. CVE-2026-98854 has been patched. Fixed versions include 6.12.113, 6.18.56, 7.2.10 and others. If you are running Linux kernel 4.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98854 actively exploited?
No. CVE-2026-98854 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.