CVE-2026-98855: of/overlay: put property on deadprops only after changeset add succeeds
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: put property on deadprops only after changeset add succeeds
addchangesetproperty() links a new property of a not-yet-live target node into the node's deadprops list before handing it to ofchangesetaddproperty(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and ofnoderelease() frees it a second time when the aborted overlay's node is released.
Record the changeset entry first and link the property into deadprops only on success. ofchangesetaddproperty() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.
Affected Software
Event History
Frequently Asked Questions
Does a successfully applied overlay trigger the issue?
The described fault requires of_changeset_add_property() to fail while adding a property for a not-yet-live target node. A successful add does not take the error path that leaves a freed property linked in deadprops.
What occurs after the relevant overlay operation fails?
The failed path frees the property while its pointer remains in the target node's deadprops list. When the aborted overlay's node is later released, of_node_release() frees that property again, causing a double free.