GHSA-VVRP-CFQ6-9C5C
Vulnerability from github – Published: 2026-10-18 18:32 – Updated: 2026-10-30 15:34In the Linux kernel, the following vulnerability has been resolved:
of/overlay: don't leak fragment references when changeset init fails
init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the symbols lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0.
Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
{
"affected": [],
"aliases": [
"CVE-2026-98831"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:37Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: don\u0027t leak fragment references when changeset init fails\n\ninit_overlay_changeset() stores the number of initialized fragments\nin ovcs-\u003ecount only on full success. When find_target() or the\n__symbols__ lookup fails partway through, the target and overlay\nreferences taken for the fragments initialized so far are never\ndropped: free_overlay_changeset() bounds its cleanup loop by\novcs-\u003ecount, which is still 0.\n\nStore the running count on the error path so free_overlay_changeset()\nputs whatever was set up. The store is guarded by ovcs-\u003efragments\nbecause on the allocation-failure path cnt still holds the counting\npass total while there is no fragments array; everywhere else cnt\nonly counts fully-initialized fragments.",
"id": "GHSA-vvrp-cfq6-9c5c",
"modified": "2026-10-30T15:34:04Z",
"published": "2026-10-18T18:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98831"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a23fb158ba517b77a2e5258263bdfdaa480f758"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/64517aeaa3d8b158e4d01321a095be48cb551251"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/702b5db6e7b3865be70675d57d6fd7dde80d02b6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7a46f1917b320cc8762183b802301da02a191b6a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/894573e2fdaeb1b15030b7eebc22615edf28a6cd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bbe3dc64b28a14bd9ecb514bbf5115ac8472ed80"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c654f283d7db20648a5bbf979209f78d4fa9be3f"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.