Cloudanix VulnDB

CVE-2026-98854

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the operating system handles certain device configuration changes could cause the core system to crash when an internal operation fails.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A negative return value from idr_alloc is stored in ovcs->id without validation; on failure free_overlay_changeset performs idr_remove with the negative ID and list_del on an uninitialized ovcs->ovcs_list, dereferencing NULL.

Why it matters to the business

Kernel crashes or instability can occur on systems that apply device tree overlays when an internal allocation fails during the operation.

How an attack unfolds

An attacker triggers device tree overlay application while forcing idr_alloc to fail, causing the kernel error path to dereference an uninitialized list and crash the system.

How to fix it

Apply the upstream kernel fix that changes the registration check to require a strictly positive ID before performing idr_remove and list_del.

How to confirm the fix worked

Inspect the free_overlay_changeset function to confirm the guard now requires ovcs->id > 0 before cleanup operations; test overlay apply paths under allocation failure conditions.

Typical attack path

  1. Cause a device tree overlay to be applied
  2. Induce idr_alloc failure during changeset registration
  3. Trigger free_overlay_changeset on the partially initialized structure
  4. Produce NULL dereference and kernel panic

How to detect it

Examine kernel logs and oops reports for NULL pointer dereferences originating from overlay changeset cleanup functions; correlate with device tree overlay apply attempts.

What your security team should do

  • Prioritize kernel updates containing the overlay changeset ID fix within standard patch windows
  • Review device tree overlay usage in embedded and server deployments
  • Monitor upstream stable kernel releases for backports

The record

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL. Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.

Affected packages

Ecosystem Package Introduced Fixed