Cloudanix VulnDB

CVE-2026-98855

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recently fixed Linux kernel bug could let an attacker who can load special hardware-description data cause memory errors that crash the system or possibly run malicious code.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double-free in the Linux kernel device-tree overlay code when add_changeset_property fails after the property pointer has already been linked into the deadprops list, allowing the same allocation to be released twice during node cleanup.

Why it matters to the business

Kernel memory corruption on systems that apply device-tree overlays can lead to crashes, denial of service, or potential local privilege escalation; the issue affects embedded, server, and desktop Linux deployments that use dynamic DT overlays.

How an attack unfolds

An attacker with the ability to supply or trigger a device-tree overlay crafts input that causes of_changeset_add_property to fail after the property has been recorded in deadprops; the subsequent of_node_release then frees the already-freed object, resulting in a use-after-free condition that can be leveraged for memory manipulation.

How to fix it

Update to a Linux kernel containing the fix that records the changeset entry before linking the property into deadprops; apply the patch or upgrade to a distribution kernel released after 2026-10-18 that resolves the ordering issue in of/overlay.c.

How to confirm the fix worked

Confirm the presence of the corrected ordering (changeset entry recorded before deadprops link) in the of_changeset_add_property error path; re-test overlay application with forced failure scenarios and verify no double-free occurs under memory debugging tools such as KASAN.

Typical attack path

  1. Obtain or generate a malicious device-tree overlay blob
  2. Trigger overlay application via kernel interface or userspace tool
  3. Force the changeset addition to fail after the deadprops link is established
  4. Cause the overlay node to be released, triggering the second free
  5. Exploit the resulting use-after-free for arbitrary memory read/write or control-flow hijack

How to detect it

Review kernel logs for double-free or slab corruption warnings during overlay application; look for failed of_changeset_add_property calls followed by of_node_release on the same overlay node; correlate with attempts to apply device-tree overlays from untrusted sources.

What your security team should do

  • Prioritize kernel updates on all systems that apply device-tree overlays within the next 30 days
  • Restrict untrusted users from loading device-tree overlays via kernel command-line or sysfs interfaces
  • Enable KASAN or similar memory debugging on test systems to validate the fix
  • Monitor upstream stable kernel releases and distribution security advisories for backported patches

The record

In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of_changeset_add_property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of_node_release() frees it a second time when the aborted overlay's node is released. Record the changeset entry first and link the property into deadprops only on success. of_changeset_add_property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.

Affected packages

Ecosystem Package Introduced Fixed