Linux Kernel Vulnerability in Overlay Changeset Management by Vendor Linux

CVE-2026-98854

What is CVE-2026-98854?

A vulnerability exists in the Linux kernel's handling of overlay changesets, specifically in the function 'of_overlay_fdt_apply()'. This function fails to adequately verify the validity of changeset IDs after allocation, leading to a scenario where a negative ID may result in improper dereferencing of NULL pointers. This can lead to unstable system behavior. To mitigate this issue, the function has been revised to only accept strictly positive IDs as registered, ensuring better resource management and reducing the potential for exploitation through uninitialized data access.

References