CVE-2026-89498

Summary

In the Linux kernel, the following vulnerability has been resolved:

orangefs: fix double-free of trailer_buf on readdir copy failure

On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies.

Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < 712c4235fcc73c11a2f1d59a499d489e49c374a4affected
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < 433c2e470053cc9c712314d3d8c3dfbc862d68ebaffected
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < 6e5924644ef4bce06a3cbb7cb841a8bbfdfc03adaffected
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < 9c9eacc47c618ed6d7d35fe75a40d294c8cdbffaaffected
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < 2f5454a25127854c232fde5d1d65d16fbcd42d43affected
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < f796f38a324e89547738f4b70cc33be5be2bc6daaffected
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < 519f4146b8b8c5f20c2ad01913acd6df2df8fc8eaffected
LinuxLinux382f4581e67f57209c7aa67e39f26ba076306a2e < f574296be7f46eb60beca851240b526df232f480affected
LinuxLinux4.12affected
LinuxLinux0 < 4.12unaffected
LinuxLinux5.10.270 <= 5.10.*unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.109 <= 6.12.*unaffected
LinuxLinux6.18.50 <= 6.18.*unaffected
LinuxLinux7.2.4 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References