CVE-2026-98854: of/overlay: only treat a positive changeset id as registered
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: only treat a positive changeset id as registered
ofoverlayfdtapply() stores the idralloc() return value in ovcs->id before checking it. On failure the stored id is negative, freeoverlaychangeset()'s "if (ovcs->id)" check passes, idrremove() is called with a negative id and listdel() runs on ovcs->ovcslist, which is not initialized until after the id allocation. An allocation failure at that point dereferences NULL.
Make freeoverlaychangeset() treat only a strict-positive id as registered. The rest of the function already copes with a partially-initialized ovcs, so the error path stays a plain goto errfreeovcs.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the vulnerable path?
The issue is triggered when idr_alloc() fails during of_overlay_fdt_apply(). The failed allocation stores a negative ID before cleanup runs, causing cleanup to attempt removal of an unregistered, partially initialized overlay changeset.
What happens when the vulnerable error path is reached?
The cleanup path can call idr_remove() with a negative ID and run list_del() on an uninitialized ovcs_list. This results in a NULL dereference.
What should be done if the issue cannot be patched immediately?
The provided information does not specify a workaround. The described failure depends on an allocation failure while applying a device-tree overlay, so systems that do not exercise that operation would not reach this specific path.