CVE-2026-98855Medium· 4.4▾ SunlitA flaw was found in the Linux kernel's Device Tree overlay subsystem. When an error occurs while adding a property to a device tree overlay changeset, the allocated property is freed during error cleanup but remains tracked, leading to a s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 4.4
none → medium
A flaw was found in the Linux kernel's Device Tree overlay subsystem. When an error occurs while adding a property to a device tree overlay changeset, the allocated property is freed during error cleanup but remains tracked, leading to a second release (double-free) when the overlay node is torn down. A local user could exploit this vulnerability to trigger memory corruption, potentially leading to a Denial of Service (DoS) or privilege escalation.
kernel: of/overlay: put property on deadprops only after changeset add succeeds — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.
Affected:
No fix planned:
Not affected:
Fix deferred
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107886Low· 2.3OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management
CVE-2026-97631High· 8.8edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)
CVE-2026-98869High· 7.8kernel: bpf: Infer zext_dst based on static register liveness analysis (CVE-2026-98869)
CVE-2026-53122Medium· 5.5kernel: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (CVE-2026-53122)
CVE-2026-53272Medium· 5.5kernel: erofs: fix use-after-free on sbi->sync_decompress (CVE-2026-53272)
CVE-2026-114046Medium· 6.5freerdp: FreeRDP: null pointer dereference in smartcard emulation via crafted reader name (CVE-2026-114046)