Live › vulnerability › CVE-2026-98855
Go to dashboardWhen a device-tree overlay fails to apply, the kernel frees a property but leaves a pointer to it linked in the node's deadprops list. The node's release path then frees the same property again, a double free.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: put property on deadprops only after changeset add succeeds
add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of_changeset_add_property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of_node_release() frees it a second time when the aborted overlay's node is released.
Record the changeset entry first and link the property into deadprops only on success. of_changeset_add_property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.
This page as .md · .json · in your agent: get_signal("CVE-2026-98855")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.