Cloudanix VulnDB

CVE-2026-98831

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can waste memory when handling certain hardware configuration updates, potentially making systems less stable until fixed.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability causes a reference leak for overlay fragments in the device tree overlay mechanism when changeset initialization fails midway through processing, preventing proper cleanup in free_overlay_changeset() because the fragment count is not updated on partial failure paths.

Why it matters to the business

Repeated triggering on Linux systems could lead to gradual kernel memory depletion, risking system instability, crashes, or degraded performance especially in environments that frequently apply device tree overlays.

How an attack unfolds

An attacker with local access or ability to supply device tree overlays triggers init_overlay_changeset() such that find_target() or symbol lookup fails after some fragments are initialized; the missing count update leaves references held, and repeated attempts accumulate leaks without invoking cleanup.

How to fix it

Apply the upstream kernel patch for of/overlay that stores the running fragment count on error paths inside init_overlay_changeset() so free_overlay_changeset() performs proper cleanup; rebuild and deploy the fixed kernel version across affected systems.

How to confirm the fix worked

Inspect the of/overlay.c source for the guarded store of the running count on error paths before the fragments array allocation check; confirm via kernel build logs or runtime tests that partial-failure overlay scenarios now release references.

Typical attack path

  1. Obtain local execution or overlay loading capability on a Linux system
  2. Supply a malformed or specially timed device tree overlay that causes partial failure during fragment initialization
  3. Repeat the operation to accumulate unreleased fragment references
  4. Monitor for resulting kernel memory pressure or crashes

How to detect it

Examine kernel memory statistics and slab allocator usage for growth in device-tree or overlay structures; review dmesg or kernel logs for repeated overlay changeset initialization failures without corresponding reference decrements.

What your security team should do

  • Prioritize kernel updates containing the overlay changeset fix on all production Linux systems
  • Restrict untrusted sources from loading device tree overlays until patched
  • Monitor kernel memory usage metrics for unusual growth in overlay-related structures
  • Review and limit device tree overlay usage in embedded or virtualized deployments

The record

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0. Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.

Affected packages

Ecosystem Package Introduced Fixed