CVE-2026-98855
priority · track · 0EPSS 0.002 · 4 %ileFREPSS · scored 2026-10-22
In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add_changeset_property() links a new property of a not-yet-live target node into the node's deadprops list before handing it to of_changeset_add_property(). If that fails, the error path frees the property but leaves the freed pointer linked in deadprops, and of_node_release() frees it a second time when the aborted overlay's node is released. Record the changeset entry first and link the property into deadprops only on success. of_changeset_add_property() never looks at the node's property lists, so the order of the two steps is otherwise immaterial, and the error path frees a property that nothing references.
cvss
Technical severity, 0–10. One row per scoring source.
No CVSS score recorded.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products
Products and version ranges known to be affected.
No affected products recorded.
advisories (1)
Vendor and ecosystem advisories describing this.
- CERTFR-2026-AVI-1375Multiples vulnérabilités dans le noyau Linux de Debian LTSFrançais2026-10-23vendor · certfrFR
sources
Which sources assert this record, and when.
references (5) nvd
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/5857035a3b53a4e7b5a0d5a740189901ece0b079
- https://git.kernel.org/stable/c/7dc6a769153c0457077a0da4888a00f61e66de15
- https://git.kernel.org/stable/c/814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c
- https://git.kernel.org/stable/c/936f1ffcb87a1c50938a21176a6463af162cf4b5
- https://git.kernel.org/stable/c/d5151496a0a2b19c9c0c7b0ebf86b3de55a8fa3a
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan