Linux Kernel Overlay Deadprops: Double Free in add_changeset_property
CVE-2026-98855 Published on October 18, 2026
of/overlay: put property on deadprops only after changeset add succeeds
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: put property on deadprops only after changeset add succeeds
add_changeset_property() links a new property of a not-yet-live
target node into the node's deadprops list before handing it to
of_changeset_add_property(). If that fails, the error path frees the
property but leaves the freed pointer linked in deadprops, and
of_node_release() frees it a second time when the aborted overlay's
node is released.
Record the changeset entry first and link the property into deadprops
only on success. of_changeset_add_property() never looks at the
node's property lists, so the order of the two steps is otherwise
immaterial, and the error path frees a property that nothing
references.
Products Associated with CVE-2026-98855
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f96278810150fc39085d1872e5b39ea06366d03e and below d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a is affected.
- Version f96278810150fc39085d1872e5b39ea06366d03e and below 7dc6a769153c0457077a0da4888a00f61e66de15 is affected.
- Version f96278810150fc39085d1872e5b39ea06366d03e and below 5857035a3b53a4e7b5a0d5a740189901ece0b079 is affected.
- Version f96278810150fc39085d1872e5b39ea06366d03e and below 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c is affected.
- Version b52ca352489be8beb7de3a8181509a0deaf72e21 is affected.
- Version 4.19.49 and below 4.20 is affected.
- Version 5.0 is affected.
- Before 5.0 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.