{"id":"AZL-109218","summary":"CVE-2026-98831 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: don't leak fragment references when changeset init fails\n\ninit_overlay_changeset() stores the number of initialized fragments\nin ovcs-\u003ecount only on full success. When find_target() or the\n__symbols__ lookup fails partway through, the target and overlay\nreferences taken for the fragments initialized so far are never\ndropped: free_overlay_changeset() bounds its cleanup loop by\novcs-\u003ecount, which is still 0.\n\nStore the running count on the error path so free_overlay_changeset()\nputs whatever was set up. The store is guarded by ovcs-\u003efragments\nbecause on the allocation-failure path cnt still holds the counting\npass total while there is no fragments array; everywhere else cnt\nonly counts fully-initialized fragments.","modified":"2026-10-19T14:17:05.782274400Z","published":"2026-10-18T16:17:37Z","upstream":["CVE-2026-98831"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98831"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109218.json"}}],"schema_version":"1.9.0"}