CVE-2026-89498: orangefs: fix double-free of trailer_buf on readdir copy failure

Received
AliasesUBUNTU-CVE-2026-89498DEBIAN-CVE-2026-89498
Published 11-09-2026Last modified 19-10-2026

Vulnerability summary

CVE-2026-89498 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.8% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11880-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.18% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu168 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < 712c4235fcc73c11a2f1d59a499d489e49c374a4 | ≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < 433c2e470053cc9c712314d3d8c3dfbc862d68eb | ≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < 6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad | ≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < 9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa | ≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < 2f5454a25127854c232fde5d1d65d16fbcd42d43 | ≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < f796f38a324e89547738f4b70cc33be5be2bc6da | ≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < 519f4146b8b8c5f20c2ad01913acd6df2df8fc8e | ≥ 382f4581e67f57209c7aa67e39f26ba076306a2e, < f574296be7f46eb60beca851240b526df232f480 | 4.12

3 vendors · 171 products

References

12 links
Show all 12 references