Not yet scoredPublished Oct 18, 2026

CVE-2026-98855of/overlay: put property on deadprops only after changeset add succeeds

Updated under an hour ago (Oct 28, 2026, 1:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of_changeset_add_property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of_node_release() frees it a second time when the aborted overlay's node is released. Record the changeset entry first and link the property into deadprops only on success. of_changeset_add_property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f96278810150fc39085d1872e5b39ea06366d03e before 936f1ffcb87a1c50938a21176a6463af162cf4b5; from f96278810150fc39085d1872e5b39ea06366d03e before d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a; from f96278810150fc39085d1872e5b39ea06366d03e before 7dc6a769153c0457077a0da4888a00f61e66de15; from f96278810150fc39085d1872e5b39ea06366d03e before 5857035a3b53a4e7b5a0d5a740189901ece0b079; from f96278810150fc39085d1872e5b39ea06366d03e before 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c; b52ca352489be8beb7de3a8181509a0deaf72e21; from 4.19.49 before 4.20	CNA record

References

References

https://git.kernel.org/stable/c/936f1ffcb87a1c50938a21176a6463af162cf4b5
https://git.kernel.org/stable/c/d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a
https://git.kernel.org/stable/c/7dc6a769153c0457077a0da4888a00f61e66de15
https://git.kernel.org/stable/c/5857035a3b53a4e7b5a0d5a740189901ece0b079
https://git.kernel.org/stable/c/814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.