In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds… (CVE-2026-98855)

The vulnerability in the Linux kernel relates to the function add_changeset_property() which links a new property of a not-yet-live target node into the node's deadprops list before calling of_changeset_add_property(). If of_changeset_add_property() fails, the property is freed but the pointer remains linked in deadprops, causing a double free when of_node_release() later frees the aborted overlay's node. The fix changes the order to record the changeset entry first and link the property into deadprops only upon success, eliminating the double free condition.

The vulnerability can cause a double free of memory within the kernel, which may lead to kernel crashes or potential memory corruption. However, no known exploits in the wild have been reported. The impact is primarily stability and potential security risks related to memory management errors in the kernel.

A fix has been applied to the Linux kernel source code to correct the order of operations in handling overlay properties, preventing the double free. Users should update to the latest patched kernel version containing this fix. No additional mitigation steps are indicated.