Live › vulnerability › CVE-2026-98831
Go to dashboardWhen applying a device tree overlay to the Linux kernel fails partway through, references taken on already-initialized fragments are never released. The sources describe a resource leak, not a code execution path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that load device tree overlays through the kernel's of/overlay code, typically embedded boards or hardware with runtime overlay loading. Machines that never apply overlays are unlikely to be exposed. The sources do not give more detail.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: don't leak fragment references when changeset init fails
init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the symbols lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0.
Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
This page as .md · .json · in your agent: get_signal("CVE-2026-98831")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.