Live › vulnerability › CVE-2026-98854
Go to dashboardWhen applying a device tree overlay fails during ID allocation, the kernel's cleanup path treats a negative ID as valid and calls list operations on an uninitialized list, which dereferences NULL. The sources describe a kernel crash from this bug; they do not state that an attacker can trigger it or gain control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load device tree overlays through the of/overlay code path are exposed, typically embedded or ARM boards with runtime device tree configuration. Servers and desktops that never apply device tree overlays can likely skip it. Whether an unprivileged user can trigger the allocation failure is unknown from these sources.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel version in your distribution's advisory (unknown from these sources)ls /sys/kernel/config/device-tree/overlays (unknown if this path is used)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: only treat a positive changeset id as registered
of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On failure the stored id is negative, free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id and list_del() runs on ovcs->ovcs_list, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL.
Make free_overlay_changeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto err_free_ovcs.
This page as .md · .json · in your agent: get_signal("CVE-2026-98854")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.