SB20261022450 - Missing Release of Resource after Effective Lifetime in Linux kernel of driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022450

SB20261022450 - Missing Release of Resource after Effective Lifetime in Linux kernel of driver

Published: October 22, 2026

Security Bulletin ID SB20261022450
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98831)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to leak kernel resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing release of fragment references in the Linux kernel device tree overlay component when overlay changeset initialization fails after some fragments have been initialized. A local user can potentially trigger repeated initialization failures to accumulate unreleased target and overlay references and exhaust kernel resources.


Remediation

Install update from vendor's website.

References