In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered… (CVE-2026-98854)

The vulnerability in the Linux kernel's of/overlay code arises because of_overlay_fdt_apply() stores the return value of idr_alloc() in ovcs->id before checking for failure. If idr_alloc() fails, it returns a negative value, which is stored in ovcs->id. Later, free_overlay_changeset() checks if ovcs->id is non-zero and proceeds to call idr_remove() with this negative ID and list_del() on ovcs->ovcs_list, which is not initialized at this point. This leads to a NULL pointer dereference and potential kernel crash. The fix ensures free_overlay_changeset() only treats strictly positive IDs as registered, preventing the erroneous cleanup path.

This vulnerability can cause a NULL pointer dereference in the Linux kernel, leading to a denial of service via kernel crash. There is no indication of code execution or privilege escalation from the provided data.

A fix has been applied to the Linux kernel source code to address this issue by modifying free_overlay_changeset() to only treat strictly positive IDs as registered. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official patch and update guidance.