{"id":"CVE-2026-98831","kind":"vulnerability","aliases":["CVE-2026-98831"],"related":[],"title":"Linux kernel: device tree overlay setup leaks references on failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: don't leak fragment references when changeset init fails\n\ninit_overlay_changeset() stores the number of initialized fragments\nin ovcs->count only on full success. When find_target() or the\n__symbols__ lookup fails partway through, the target and overlay\nreferences taken for the fragments initialized so far are never\ndropped: free_overlay_changeset() bounds its cleanup loop by\novcs->count, which is still 0.\n\nStore the running count on the error path so free_overlay_changeset()\nputs whatever was set up. The store is guarded by ovcs->fragments\nbecause on the allocation-failure path cnt still holds the counting\npass total while there is no fragments array; everywhere else cnt\nonly counts fully-initialized fragments.","summary":"When applying a device tree overlay to the Linux kernel fails partway through, references taken on already-initialized fragments are never released. The sources describe a resource leak, not a code execution path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-tree","embedded","infrastructure","linux-kernel"],"not_affected_if":["no-dt-overlays"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit resolving CVE-2026-98831 (fixed version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:20+00:00","updated_at":"2026-10-25T05:13:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:13:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit resolving CVE-2026-98831 (fixed version unknown from sources)","reach":"local","title":"Linux kernel: device tree overlay setup leaks references on failure","impact":"low","summary":"When applying a device tree overlay to the Linux kernel fails partway through, references taken on already-initialized fragments are never released. The sources describe a resource leak, not a code execution path.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","device-tree"],"confidence":0.5,"needs_auth":"unknown","worst_case":"reference leak on failed overlay setup; memory or resource exhaustion","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-dt-overlays"],"who_is_affected":"Systems that load device tree overlays through the kernel's of/overlay code, typically embedded boards or hardware with runtime overlay loading. Machines that never apply overlays are unlikely to be exposed. The sources do not give more detail.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000556,"input_tokens":3475,"output_tokens":417,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98831':13A,16A '0':133C 'alloc':162C 'allocation-failur':161C 'alreadi':42B 'already-initi':41B 'appli':26B 'array':177C 'bound':123C 'changeset':76C,81C,122C,145C 'cleanup':125C 'cnt':165C,180C 'code':56B 'count':90C,129C,137C,169C,182C 'cve':11A,14A 'describ':50B 'devic':3A,18B,28B 'device-tre':17B 'drop':119C 'els':179C 'embed':20B 'error':140C 'everywher':178C 'execut':57B 'fail':35B,78C,102C 'failur':10A,163C 'far':116C 'find':96C 'follow':64C 'fragment':44B,73C,87C,113C,157C,176C,186C 'free':120C,143C 'full':93C 'fulli':184C 'fully-initi':183C 'guard':154C 'hold':167C 'infrastructur':21B 'init':77C,79C 'initi':43B,86C,114C,185C 'kernel':2A,24B,34B,62C 'leak':7A,53B,72C 'linux':1A,23B,33B,61C 'linux-kernel':22B 'lookup':101C 'loop':126C 'never':46B,118C 'number':84C 'of/overlay':69C 'ovc':89C,128C,156C 'overlay':5A,30B,80C,108C,121C,144C 'partway':36B,103C 'pass':170C 'path':58B,141C,164C 'put':146C 'refer':8A,38B,74C,109C 'releas':47B 'resolv':68C 'resourc':52B 'run':136C 'set':149C 'setup':6A 'sourc':49B 'still':132C,166C 'store':82C,134C,152C 'success':94C 'symbol':100C 'taken':39B,110C 'target':97C,106C 'total':171C 'tree':4A,19B,29B 'vulner':65C 'whatev':147C","nicknames":[],"mitigations":[],"who_affected":"Systems that load device tree overlays through the kernel's of/overlay code, typically embedded boards or hardware with runtime overlay loading. Machines that never apply overlays are unlikely to be exposed. The sources do not give more detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98831","severity":null,"published_at":"2026-10-18T16:17:37+00:00","modified_at":"2026-10-21T13:21:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}