In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetag_load_module() If codetag_load_module()… (CVE-2026-98842)

The Linux kernel contained a vulnerability where codetag_load_module() failed to set an error code when it encountered an error, leading load_module() to return 0 (success) despite the module being torn down. This could cause incorrect error handling by callers. Furthermore, for livepatch modules, the mod->klp_info structure allocated by copy_module_elf() leaked memory on this failure path. The fix involves setting the error code correctly and freeing the livepatch info via a new livepatch_cleanup label.

The vulnerability could cause the kernel to incorrectly report successful module loading when it actually failed, potentially leading to inconsistent system states or error handling issues. The memory leak in livepatch modules could lead to resource exhaustion over time if the error path is triggered repeatedly. There is no indication of direct exploitation or security breach from this flaw.

A fix has been implemented to address this vulnerability by correcting error code handling and cleaning up leaked memory in livepatch modules. Users should update their Linux kernel to the fixed version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.