Linux Kernel Vulnerability in Overlay Changeset Management

CVE-2026-98855

What is CVE-2026-98855?

This vulnerability in the Linux kernel stems from improper handling of properties during the overlay changeset process. Specifically, the add_changeset_property() function improperly links a property of a target node that has not yet been activated into the node's list of dead properties before confirming the success of adding the changeset. If the addition fails, this can lead to a scenario where the property, still linked, is erroneously freed again during the release of the aborted overlay node. This oversight in resource management could potentially lead to unstable system behavior, emphasizing the importance of appropriate sequencing in property handling.

References