CVE-2026-98831

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: don't leak fragment references when changeset init fails

init_overlay_changeset() stores the number of initialized fragments

in ovcs->count only on full success. When find_target() or the

__symbols__ lookup fails partway through, the target and overlay

references taken for the fragments initialized so far are never

dropped: free_overlay_changeset() bounds its cleanup loop by

ovcs->count, which is still 0.

Store the running count on the error path so free_overlay_changeset()

puts whatever was set up. The store is guarded by ovcs->fragments

because on the allocation-failure path cnt still holds the counting

pass total while there is no fragments array; everywhere else cnt

only counts fully-initialized fragments.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References