CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails
A memory leak in the Linux kernel's overlay changeset initialization can lead to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98831?
CVE-2026-98831 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
of/overlay: don't leak fragment references when changeset init fails
init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, the target and overlay references taken for the fragments initialized so far are never dropped: free_overlay_changeset() bounds its cleanup loop by ovcs->count, which is still 0.
Store the running count on the error path so free_overlay_changeset() puts whatever was set up. The store is guarded by ovcs->fragments because on the allocation-failure path cnt still holds the counting pass total while there is no fragments array; everywhere else cnt only counts fully-initialized fragments.
Which versions are affected by CVE-2026-98831?
How do I fix CVE-2026-98831?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98831 being exploited?
There is no known exploitation of CVE-2026-98831 in the wild and no public exploit code.
Sources
Also known as AZL-109218, BELL-CVE-2026-98831, DEBIAN-CVE-2026-98831, GHSA-vvrp-cfq6-9c5c, UBUNTU-CVE-2026-98831.