Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98831

of/overlay: don't leak fragment references when changeset init fails

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.6.160, 6.12.113, 6.18.56, 7.2.10
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the symbols lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0. Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    4.15

  • KernelLinux

    From 4.15.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.56; From 6.19.0 · fixed in 7.2.10

References 8

git.kernel.org