CVE-2026-98855: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98855 Overview

CVE-2026-98855 is a double-free vulnerability in the Linux kernel's Open Firmware (OF) device tree overlay subsystem. The flaw resides in add_changeset_property() within the of/overlay code path. The function links a new property into the target node's deadprops list before calling of_changeset_add_property(). When the changeset add fails, the error path frees the property but leaves the dangling pointer linked in deadprops. A subsequent call to of_node_release() frees the same memory a second time when the aborted overlay's node is released.

Critical Impact
Memory corruption via double free during device tree overlay application failure can lead to kernel instability or potential privilege escalation on affected Linux systems.

Affected Products

Linux kernel (upstream) with the of/overlay subsystem
Stable kernel branches referenced by the fix commits 5857035a, 7dc6a769, 814f2da6, 936f1ffc, and d5151496
Linux distributions and embedded platforms that apply device tree overlays at runtime

Discovery Timeline

2026-10-18 - CVE-2026-98855 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98855

Vulnerability Analysis

The vulnerability is a double free [CWE-415] in the device tree overlay changeset handling code. Device tree overlays allow runtime modification of hardware descriptions, commonly used on embedded ARM platforms and systems supporting dynamic hardware reconfiguration. The add_changeset_property() function constructs a new property for a target node that is not yet live and attempts to register it with the changeset machinery via of_changeset_add_property().

The ordering bug places the new property on the node's deadprops list before the changeset registration succeeds. If of_changeset_add_property() returns an error, the cleanup path frees the property memory directly. The freed pointer, however, remains linked in deadprops. When the overlay application aborts and the node is later torn down, of_node_release() walks deadprops and frees each entry, releasing the already-freed property a second time.

Root Cause

The root cause is incorrect ordering of two operations in add_changeset_property(). The property is linked into the persistent deadprops list before the changeset entry is recorded. Error handling assumes the property is not yet referenced elsewhere and frees it directly, leaving a stale pointer in the list.

Attack Vector

Triggering the bug requires the ability to apply a device tree overlay that causes of_changeset_add_property() to fail. This path is typically reachable by privileged users or kernel components that load overlays through configfs or driver interfaces. Successful exploitation corrupts kernel heap state and can produce kernel panics, slab allocator corruption, or exploitable use-after-free conditions depending on allocator behavior.

No verified public exploit code is available. See the upstream fix in Kernel Commit 5857035a for the corrected ordering, which records the changeset entry first and only links the property into deadprops on success.

Detection Methods for CVE-2026-98855

Indicators of Compromise

Kernel panics or oops messages referencing of_node_release, add_changeset_property, or of_changeset_add_property
SLUB or SLAB allocator warnings indicating double free or corrupted freelist entries after device tree overlay operations
Overlay application failures logged by the of/overlay subsystem followed shortly by kernel memory corruption diagnostics

Detection Strategies

Enable CONFIG_SLUB_DEBUG and CONFIG_DEBUG_LIST on test systems to catch double-free conditions and list corruption during overlay testing
Use KASAN (Kernel Address Sanitizer) builds to detect the use-after-free and double-free patterns described in the advisory
Monitor kernel ring buffer output for repeated failures in overlay application paths on systems that use runtime device tree reconfiguration

Monitoring Recommendations

Collect dmesg and journald kernel logs from systems that apply device tree overlays, flagging panics or BUG messages containing of_ symbols
Track kernel versions deployed across embedded and server fleets to identify hosts still running pre-patch builds
Alert on unexpected overlay load attempts via configfs paths such as /sys/kernel/config/device-tree/overlays/

How to Mitigate CVE-2026-98855

Immediate Actions Required

Apply the upstream stable kernel patches referenced in commits 5857035a, 7dc6a769, 814f2da6, 936f1ffc, and d5151496
Restrict access to device tree overlay interfaces to trusted administrative users and processes only
Audit systems that load overlays at runtime and prioritize patching for embedded and ARM-based deployments

Patch Information

The fix reorders operations in add_changeset_property() so the changeset entry is recorded first, and the property is linked into deadprops only after of_changeset_add_property() succeeds. On failure, the error path frees a property that nothing else references, eliminating the double free. Patches are available in the mainline Linux kernel tree and backported to stable branches via the commits listed in the references.

Workarounds

Disable runtime device tree overlay support where feasible by removing CONFIG_OF_OVERLAY from kernel builds
Unmount or restrict permissions on configfs overlay directories to prevent unprivileged overlay loading
Avoid applying untested or third-party device tree overlays on production systems until kernels are patched

bash

# Verify kernel version and overlay configuration
uname -r
zcat /proc/config.gz | grep CONFIG_OF_OVERLAY

# Restrict access to configfs overlay interface
chmod 700 /sys/kernel/config/device-tree/overlays/