CVE-2026-89498orangefs: fix double-free of trailer_buf on readdir copy failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 382f4581e67f57209c7aa67e39f26ba076306a2e before 712c4235fcc73c11a2f1d59a499d489e49c374a4; from 382f4581e67f57209c7aa67e39f26ba076306a2e before 433c2e470053cc9c712314d3d8c3dfbc862d68eb; 382f4581e67f57209c7aa67e39f26ba076306a2e builds before 6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad; 382f4581e67f57209c7aa67e39f26ba076306a2e builds before 9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa; 382f4581e67f57209c7aa67e39f26ba076306a2e builds before 2f5454a25127854c232fde5d1d65d16fbcd42d43; from 382f4581e67f57209c7aa67e39f26ba076306a2e before f796f38a324e89547738f4b70cc33be5be2bc6da; from 382f4581e67f57209c7aa67e39f26ba076306a2e before 519f4146b8b8c5f20c2ad01913acd6df2df8fc8e; from 382f4581e67f57209c7aa67e39f26ba076306a2e before f574296be7f46eb60beca851240b526df232f480 | CNA record |
References
- https://git.kernel.org/stable/c/712c4235fcc73c11a2f1d59a499d489e49c374a4
- https://git.kernel.org/stable/c/433c2e470053cc9c712314d3d8c3dfbc862d68eb
- https://git.kernel.org/stable/c/6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad
- https://git.kernel.org/stable/c/9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa
- https://git.kernel.org/stable/c/2f5454a25127854c232fde5d1d65d16fbcd42d43
- https://git.kernel.org/stable/c/f796f38a324e89547738f4b70cc33be5be2bc6da
- https://git.kernel.org/stable/c/519f4146b8b8c5f20c2ad01913acd6df2df8fc8e
- https://git.kernel.org/stable/c/f574296be7f46eb60beca851240b526df232f480
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.