{"id":"CVE-2026-98855","kind":"vulnerability","aliases":["CVE-2026-98855"],"related":[],"title":"Linux kernel: failed device-tree overlay can free a property twice","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: put property on deadprops only after changeset add succeeds\n\nadd_changeset_property() links a new property of a not-yet-live\ntarget node into the node's deadprops list before handing it to\nof_changeset_add_property(). If that fails, the error path frees the\nproperty but leaves the freed pointer linked in deadprops, and\nof_node_release() frees it a second time when the aborted overlay's\nnode is released.\n\nRecord the changeset entry first and link the property into deadprops\nonly on success. of_changeset_add_property() never looks at the\nnode's property lists, so the order of the two steps is otherwise\nimmaterial, and the error path frees a property that nothing\nreferences.","summary":"When a device-tree overlay fails to apply, the kernel frees a property but leaves a pointer to it linked in the node's deadprops list. The node's release path then frees the same property again, a double free.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["device-tree","linux-kernel","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:59+00:00","updated_at":"2026-10-25T05:12:59+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:12:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: failed device-tree overlay can free a property twice","impact":"medium","summary":"When a device-tree overlay fails to apply, the kernel frees a property but leaves a pointer to it linked in the node's deadprops list. The node's release path then frees the same property again, a double free.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","device-tree"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the kernel stable-branch fix commits and which kernel versions carry the of/overlay code; sources give no affected versions or severity.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000503,"input_tokens":3445,"output_tokens":316,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98855':15A,18A 'abort':144C 'add':85C,87C,114C,166C 'appli':34B 'changeset':84C,88C,113C,152C,165C 'cve':13A,16A 'deadprop':51B,81C,106C,132C,160C 'devic':5A,20B,29B 'device-tre':4A,19B,28B 'doubl':65B 'entri':153C 'error':120C,188C 'fail':3A,32B,118C 'first':154C 'follow':72C 'free':9A,37B,59B,66B,122C,137C,190C 'freed':128C 'hand':109C 'immateri':185C 'kernel':2A,24B,36B,70C 'leav':41B,126C 'link':46B,90C,130C,156C 'linux':1A,23B,69C 'linux-kernel':22B 'list':52B,107C,175C 'live':99C 'look':169C 'never':168C 'new':92C 'node':49B,54B,101C,104C,135C,147C,172C 'not-yet-l':96C 'noth':194C 'of/overlay':77C 'order':178C 'otherwis':184C 'overlay':7A,31B,145C 'path':57B,121C,189C 'pointer':43B,129C 'properti':11A,39B,62B,79C,89C,93C,115C,124C,158C,167C,174C,192C 'put':78C 'record':150C 'refer':195C 'releas':56B,136C,149C 'resolv':76C 'runtim':25B 'second':140C 'step':182C 'succeed':86C 'success':163C 'target':100C 'time':141C 'tree':6A,21B,30B 'twice':12A 'two':181C 'vulner':73C 'yet':98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98855","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-21T13:21:50+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}