CVE-2026-98831 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: don't leak fragment references when changeset init fails
init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0.
Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel device tree overlay subsystem contains a resource management flaw within the init_overlay_changeset function that leads to reference leaks when initialization fails partway through execution. This vulnerability stems from an inconsistent handling of fragment references during the setup phase of applying overlays to the device tree structure. The core issue lies in how the system tracks which fragments have been successfully initialized and associated with their respective targets or symbol lookups. When the process encounters a failure, such as when find_target cannot locate a valid target node or when _symbols_ lookup fails for a specific fragment, the function does not properly update its internal state to reflect the partial progress made before the error occurred.
The technical mechanism of this flaw involves the ovcs structure, which holds metadata about the overlay changeset including an array of fragments and a count variable named count. Under normal successful operation, init_overlay_changeset increments and stores the number of initialized fragments in ovcs->count only after all steps for each fragment are completed successfully. However, if an error occurs during the processing of any given fragment, the function returns early without updating this counter. Consequently, the value remains at zero or reflects a previous state rather than the actual number of references that were acquired but not yet released. This discrepancy creates a critical gap in resource tracking where allocated resources are effectively orphaned because the cleanup routine is unaware they exist.
The operational impact manifests as memory and reference leaks within the kernel space, specifically affecting device tree nodes and associated data structures. The free_overlay_changeset function relies entirely on ovcs->count to determine how many fragments need to be cleaned up by dropping their references. Since this count remains zero during error paths where initialization failed partially, the cleanup loop is bypassed or executed with an incorrect bound that does not cover all allocated resources. This results in persistent leaks of fragment references and potentially target node references, which can lead to increased memory consumption over time if such errors are triggered repeatedly. In severe cases involving sensitive system configurations, these leaks could contribute to resource exhaustion conditions affecting system stability.
This vulnerability aligns with CWE-401, which describes a missing release of resources after effective use, as well as CWE-755 related to improper handling of unusual or exceptional input conditions where error paths fail to clean up allocated state. From an attacker perspective, while this is primarily a reliability issue rather than a direct privilege escalation vector, it can be leveraged in denial-of-service scenarios by repeatedly triggering overlay application failures to exhaust kernel memory resources over extended periods. The ATT&CK framework categorizes such resource exhaustion techniques under T1496, specifically relating to system exploitation for availability impact through resource consumption attacks that degrade service quality or cause crashes due to unmanaged state accumulation.
Mitigation strategies require applying the upstream Linux kernel patch that corrects the logic within init_overlay_changeset to ensure the running count is stored on error paths before returning. This ensures that free_overlay_changeset receives accurate information about which fragments were successfully initialized and must therefore have their references dropped during cleanup. The fix specifically guards this store operation with a check for ovcs->fragments because in allocation failure scenarios, the counter variable may still hold totals from counting passes rather than actual initialized fragment counts where no array exists yet. System administrators should ensure that kernel packages are updated to include these corrections and monitor system logs for repeated device tree overlay errors which might indicate active exploitation attempts or configuration issues leading to resource leaks.