CVE-2026-98854

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

of/overlay: only treat a positive changeset id as registered

of_overlay_fdt_apply() stores the idr_alloc() return value in

ovcs->id before checking it. On failure the stored id is negative,

free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove()

is called with a negative id and list_del() runs on ovcs->ovcs_list,

which is not initialized until after the id allocation. An allocation

failure at that point dereferences NULL.

Make free_overlay_changeset() treat only a strict-positive id as

registered. The rest of the function already copes with a

partially-initialized ovcs, so the error path stays a plain

goto err_free_ovcs.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References