Linux Kernel: Overlay Changeset Leak on Init Failure
CVE-2026-98831 Published on October 18, 2026
of/overlay: don't leak fragment references when changeset init fails
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: don't leak fragment references when changeset init fails
init_overlay_changeset() stores the number of initialized fragments
in ovcs->count only on full success. When find_target() or the
__symbols__ lookup fails partway through, the target and overlay
references taken for the fragments initialized so far are never
dropped: free_overlay_changeset() bounds its cleanup loop by
ovcs->count, which is still 0.
Store the running count on the error path so free_overlay_changeset()
puts whatever was set up. The store is guarded by ovcs->fragments
because on the allocation-failure path cnt still holds the counting
pass total while there is no fragments array; everywhere else cnt
only counts fully-initialized fragments.
Products Associated with CVE-2026-98831
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 61b4de4e0b384f4a22c55c3bada604da49cec4e1 and below 894573e2fdaeb1b15030b7eebc22615edf28a6cd is affected.
- Version 61b4de4e0b384f4a22c55c3bada604da49cec4e1 and below 7a46f1917b320cc8762183b802301da02a191b6a is affected.
- Version 61b4de4e0b384f4a22c55c3bada604da49cec4e1 and below 3a23fb158ba517b77a2e5258263bdfdaa480f758 is affected.
- Version 61b4de4e0b384f4a22c55c3bada604da49cec4e1 and below 1d62f0f2bc7edb12ed09f71203df0e47fa4efca4 is affected.
- Version 4.15 is affected.
- Before 4.15 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.