CVE-2026-98831 - Vulnerability Details

- of/overlay: don't leak fragment references when changeset init fails

Description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: don't leak fragment references when changeset init fails

init_overlay_changeset() stores the number of initialized fragments
in ovcs->count only on full success. When find_target() or the
__symbols__ lookup fails partway through, the target and overlay
references taken for the fragments initialized so far are never
dropped: free_overlay_changeset() bounds its cleanup loop by
ovcs->count, which is still 0.

Store the running count on the error path so free_overlay_changeset()
puts whatever was set up. The store is guarded by ovcs->fragments
because on the allocation-failure path cnt still holds the counting
pass total while there is no fragments array; everywhere else cnt
only counts fully-initialized fragments.

Published: 2026-10-18

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the overlay subsystem failed to correctly clean up fragment references when a changeset initialization aborted partway. Because the count of initialized fragments was only stored on full success, the cleanup routine bounded itself by an unused counter and left fragment references allocated. This could lead to memory leaks or kernel instability if an attacker could force such a failure, potentially causing a denial of service. The fix ensures the running count is stored on the error path so cleanup releases any fragments that were successfully set up before the error. The issue is related to improper resource release.

Affected Systems

Any Linux kernel that includes the "of/overlay" driver is potentially affected. The vendor list notes Linux:Linux, and no specific version identifiers are provided, so the vulnerability applies to kernel releases containing the overlay changeset code prior to the described patch.

Risk and Exploitability

With a CVSS score of 2.3 the vulnerability is low severity. The EPSS score remains below 1% and it is not listed in CISA KEV. The defect causes leaked fragment references when changeset initialization fails, which could lead to a memory leak and kernel instability if an attacker repeatedly triggers failure. Although the impact is not catastrophic, the kernel remains a critical component; patching promptly mitigates the risk of denial of service in environments using overlay mounts. The issue is associated with CWE-772.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< c654f283d7db20648a5bbf979209f78d4fa9be3f
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 64517aeaa3d8b158e4d01321a095be48cb551251
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 702b5db6e7b3865be70675d57d6fd7dde80d02b6
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 894573e2fdaeb1b15030b7eebc22615edf28a6cd
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 7a46f1917b320cc8762183b802301da02a191b6a
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 3a23fb158ba517b77a2e5258263bdfdaa480f758
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 1d62f0f2bc7edb12ed09f71203df0e47fa4efca4

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,894573e2fdaeb1b15030b7eebc22615edf28a6cd)`	affected	code_commit	—
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,7a46f1917b320cc8762183b802301da02a191b6a)`	affected	code_commit	—
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,3a23fb158ba517b77a2e5258263bdfdaa480f758)`	affected	code_commit	—
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,1d62f0f2bc7edb12ed09f71203df0e47fa4efca4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	semver	—
`[6.12.113,7.0.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a release that includes the fixed overlay changeset logic or apply the vendor‑issued patch that records the fragment count on error paths.
Re‑compile and install the patched kernel, ensuring that the new kernel image is booted.
Validate that the overlay subsystem no longer leaks fragment references by exercising a controlled changeset failure and checking system logs or memory usage for cleanup failures.
If a newer stable kernel is available, upgrade to that release, as it will contain the fix and additional kernel hardening improvements.

Generated by OpenCVE AI on October 24, 2026 at 03:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98831.mbox
https://git.kernel.org/stable/c/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4
https://git.kernel.org/stable/c/3a23fb158ba517b77a2e5258263bdfdaa480f758
https://git.kernel.org/stable/c/64517aeaa3d8b158e4d01321a095be48cb551251
https://git.kernel.org/stable/c/702b5db6e7b3865be70675d57d6fd7dde80d02b6
https://git.kernel.org/stable/c/7a46f1917b320cc8762183b802301da02a191b6a
https://git.kernel.org/stable/c/894573e2fdaeb1b15030b7eebc22615edf28a6cd
https://git.kernel.org/stable/c/bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80
https://git.kernel.org/stable/c/c654f283d7db20648a5bbf979209f78d4fa9be3f
https://nvd.nist.gov/vuln/detail/CVE-2026-98831
https://www.cve.org/CVERecord?id=CVE-2026-98831

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/64517aeaa3d8b158e4d01321a095be48cb551251 https://git.kernel.org/stable/c/bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80 https://git.kernel.org/stable/c/c654f283d7db20648a5bbf979209f78d4fa9be3f

Sat, 24 Oct 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-682

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98831.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98831 https://www.cve.org/CVERecord?id=CVE-2026-98831
Metrics	threat_severity `None`	cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Low`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/702b5db6e7b3865be70675d57d6fd7dde80d02b6

Sun, 18 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-682

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0. Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
Title		of/overlay: don't leak fragment references when changeset init fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4 https://git.kernel.org/stable/c/3a23fb158ba517b77a2e5258263bdfdaa480f758 https://git.kernel.org/stable/c/7a46f1917b320cc8762183b802301da02a191b6a https://git.kernel.org/stable/c/894573e2fdaeb1b15030b7eebc22615edf28a6cd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:49:32.909Z

Updated: 2026-10-30T12:40:03.420Z

Reserved: 2026-09-25T10:25:14.372Z

Link: CVE-2026-98831

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:37.347

Modified: 2026-10-30T13:21:29.530

Link: CVE-2026-98831

Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98831 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T03:30:15Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object