CVE-2026-98842: module: fix lost error code from codetag_load_module()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
module: fix lost error code from codetagloadmodule()
If codetagloadmodule() fails, err is not set to reflect the failure and loadmodule() returns 0 after the module has been torn down.
Also, if the module is a livepatch, mod->klpinfo allocated by copymoduleelf() leaks on this error path. Free it via a new livepatchcleanup label.
Affected Software
1 affected component
Linux Linux kernel
Event History
Oct 18, 2026
CVE Published
via MITRE·03:50 PM
Data Sourced
via MITRE·03:50 PM
Description
Data Sourced
via NVD·04:17 PM
Description
Frequently Asked Questions
1
Can module loading appear to succeed even when the module was not retained?
Yes. If codetag_load_module() fails, load_module() can return 0 even though the module has already been torn down.
2
Is there an additional consequence for livepatch modules?
Yes. On this failure path, a livepatch module can leak the mod->klp_info allocation created by copy_module_elf(). The fix adds cleanup for that allocation.