CVE-2026-98854 - Vulnerability Details

- of/overlay: only treat a positive changeset id as registered

Description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: only treat a positive changeset id as registered

of_overlay_fdt_apply() stores the idr_alloc() return value in
ovcs->id before checking it. On failure the stored id is negative,
free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove()
is called with a negative id and list_del() runs on ovcs->ovcs_list,
which is not initialized until after the id allocation. An allocation
failure at that point dereferences NULL.

Make free_overlay_changeset() treat only a strict-positive id as
registered. The rest of the function already copes with a
partially-initialized ovcs, so the error path stays a plain
goto err_free_ovcs.

Published: 2026-10-18

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel overlay module contains a flaw where a failed changeset ID allocation is stored before validation. If the allocation fails, a negative ID is stored and later used by free_overlay_changeset(). Because list_del() is executed on an uninitialized list_head, the kernel dereferences a null pointer, causing a crash. The weakness is a null pointer dereference (CWE-476). The impact is a denial of Service by crashing the system; it does not provide a direct path for remote code execution or privilege escalation.

Affected Systems

The defect affects any Linux kernel version that includes the overlay filesystem component before the commit adding the strict positivity check for the ID. The exact version range is not disclosed, so all pre‑patch builds that contain the overlay component are considered vulnerable until an upstream update is applied.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate impact. EPSS <1% and absence from KEV suggest low likelihood of exploitation. However, the vulnerability requires a local privilege that can trigger an overlay changeset allocation; thus an attacker in a compromised or partially privileged environment could exploit it for a crash. No public exploits are available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 7af5d66d0514b8f1d759d0e32b9d4c5d26263e4a
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 71065f3d6864a101b77e7af84566757c4df415a0
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< cc688475c56d34a2b584141f9544cbe23360080d
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< c08a54df9d33dcd6ff089adc9434b2c008af3a39
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 0d1525fdcd3355672b7485d61e55df6824ab5ad1
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< c875407c34dadaef0599834ad9c815f4c9f50d15
`61b4de4e0b384f4a22c55c3bada604da49cec4e1`	affected	< 44081d708b5b885487bac792db78324b7b4c267d

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,c08a54df9d33dcd6ff089adc9434b2c008af3a39)`	affected	code_commit	—
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,0d1525fdcd3355672b7485d61e55df6824ab5ad1)`	affected	code_commit	—
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,c875407c34dadaef0599834ad9c815f4c9f50d15)`	affected	code_commit	—
`[61b4de4e0b384f4a22c55c3bada604da49cec4e1,44081d708b5b885487bac792db78324b7b4c267d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a release that includes the patch correcting the overlay changeset ID handling.
If upgrading is not immediately possible, disable the overlay filesystem by removing the overlay module or disabling it in the kernel configuration.
While the patch is pending, limit the use of overlay mounts to trusted or privileged users and monitor system logs for signs of crashes.

Generated by OpenCVE AI on October 24, 2026 at 04:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00161.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98854.mbox
https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1
https://git.kernel.org/stable/c/44081d708b5b885487bac792db78324b7b4c267d
https://git.kernel.org/stable/c/71065f3d6864a101b77e7af84566757c4df415a0
https://git.kernel.org/stable/c/7af5d66d0514b8f1d759d0e32b9d4c5d26263e4a
https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39
https://git.kernel.org/stable/c/c875407c34dadaef0599834ad9c815f4c9f50d15
https://git.kernel.org/stable/c/cc688475c56d34a2b584141f9544cbe23360080d
https://nvd.nist.gov/vuln/detail/CVE-2026-98854
https://www.cve.org/CVERecord?id=CVE-2026-98854

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/71065f3d6864a101b77e7af84566757c4df415a0 https://git.kernel.org/stable/c/7af5d66d0514b8f1d759d0e32b9d4c5d26263e4a

Sat, 24 Oct 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-457 CWE-788

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98854.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98854 https://www.cve.org/CVERecord?id=CVE-2026-98854
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/cc688475c56d34a2b584141f9544cbe23360080d

Sun, 18 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-457 CWE-476 CWE-788

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL. Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.
Title		of/overlay: only treat a positive changeset id as registered
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d1525fdcd3355672b7485d61e55df6824ab5ad1 https://git.kernel.org/stable/c/44081d708b5b885487bac792db78324b7b4c267d https://git.kernel.org/stable/c/c08a54df9d33dcd6ff089adc9434b2c008af3a39 https://git.kernel.org/stable/c/c875407c34dadaef0599834ad9c815f4c9f50d15

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:51:06.167Z

Updated: 2026-10-30T12:40:15.237Z

Reserved: 2026-09-25T10:25:14.376Z

Link: CVE-2026-98854

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:39.833

Modified: 2026-10-30T13:21:30.980

Link: CVE-2026-98854

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98854 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T05:00:19Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object