CVE-2026-98854: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98854 Overview

CVE-2026-98854 affects the Linux kernel's device tree overlay subsystem. The flaw resides in of_overlay_fdt_apply(), which stores the return value of idr_alloc() into ovcs->id before validating it. When idr_alloc() fails, the stored id is negative, yet free_overlay_changeset() treats any non-zero value as a registered id. The cleanup path then calls idr_remove() with a negative id and runs list_del() on an uninitialized ovcs->ovcs_list, dereferencing NULL. The resolved patch restricts the "registered" check to strictly positive ids so the error path falls through to goto err_free_ovcs safely.

Critical Impact
A NULL pointer dereference during device tree overlay application can crash the kernel, resulting in a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel (upstream of/overlay subsystem)
Stable kernel branches receiving the backported fixes referenced in the commits below
Distributions shipping unpatched kernels with device tree overlay support

Discovery Timeline

2026-10-18 - CVE-2026-98854 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98854

Vulnerability Analysis

The defect is a NULL pointer dereference [CWE-476] in the Linux kernel device tree (DT) overlay code path. of_overlay_fdt_apply() allocates an id via idr_alloc() and assigns the raw return value to ovcs->id. The function does not verify that the allocation succeeded before storing the value. When idr_alloc() returns a negative error code, the overlay changeset structure (ovcs) remains only partially initialized. Specifically, the ovcs_list linked-list head has not been set up.

On the error cleanup path, free_overlay_changeset() evaluates if (ovcs->id) to decide whether the changeset was ever registered. A negative id satisfies this check, causing idr_remove() to run with an invalid id and list_del() to operate on an uninitialized list head. The resulting dereference triggers a kernel oops.

Root Cause

The root cause is improper error handling of the idr_alloc() return value. The code conflates "non-zero" with "successfully registered," ignoring the fact that idr_alloc() signals failure with a negative integer. The fix changes free_overlay_changeset() to treat only strictly positive ids as registered, matching the kernel idr API contract.

Attack Vector

Triggering the flaw requires inducing an idr_alloc() failure during an of_overlay_fdt_apply() call. This generally requires local privileges capable of loading or applying device tree overlays, typically via sysfs, configfs overlay interfaces, or kernel drivers that apply overlays at runtime. Successful triggering results in a kernel NULL pointer dereference and system crash.

No verified exploit code is available. See the upstream fixes: Kernel Commit 0d1525fd, Kernel Commit 44081d70, Kernel Commit c08a54df, Kernel Commit c875407c, and Kernel Commit cc688475.

Detection Methods for CVE-2026-98854

Indicators of Compromise

Kernel oops or panic traces referencing free_overlay_changeset, of_overlay_fdt_apply, idr_remove, or list_del in dmesg or /var/log/kern.log.
Unexpected system reboots coinciding with device tree overlay load attempts.
Repeated failed overlay applications surfacing in audit logs or configfs activity.

Detection Strategies

Inventory running kernel versions and compare against the fixed commits listed in the upstream references.
Monitor for processes or drivers invoking overlay apply operations on systems that do not require runtime DT overlays.
Correlate crash dumps and kdump output with overlay-related call stacks to identify triggering workloads.

Monitoring Recommendations

Centralize kernel ring buffer and crash logs for host fleets using a SIEM or log aggregation platform.
Alert on kernel oops events referencing of/overlay call sites.
Track configfs mounts and writes under /sys/kernel/config/device-tree/overlays/ on embedded and virtualized hosts.

How to Mitigate CVE-2026-98854

Immediate Actions Required

Apply the stable kernel updates containing the referenced commits to all affected hosts.
Restrict access to device tree overlay interfaces to trusted administrative users and processes.
Rebuild and redeploy custom kernels after cherry-picking the upstream fix if full version upgrades are not immediately possible.

Patch Information

The fix modifies free_overlay_changeset() to treat only a strict-positive id as registered. The resolved commits are available upstream: Kernel Commit 0d1525fd, Kernel Commit 44081d70, Kernel Commit c08a54df, Kernel Commit c875407c, and Kernel Commit cc688475. Consume these through your distribution's stable kernel updates where available.

Workarounds

Disable runtime device tree overlay support (CONFIG_OF_OVERLAY) in kernel builds where overlays are not required.
Unmount or restrict permissions on configfs overlay directories to prevent unprivileged overlay application.
Avoid loading third-party drivers that programmatically apply device tree overlays until the patched kernel is in place.

bash

# Verify running kernel and check for overlay configfs exposure
uname -r
grep -i CONFIG_OF_OVERLAY /boot/config-$(uname -r)
mount | grep configfs
ls /sys/kernel/config/device-tree/overlays/ 2>/dev/null