{"id":"CVE-2026-89498","revision":"43d6693742ea46d8992a6d3f78325712","records":[{"revision":"43d6693742ea46d8992a6d3f78325712","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89498","aliases":[],"title":"orangefs: fix double-free of trailer_buf on readdir copy failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: fix double-free of trailer_buf on readdir copy failure\n\nOn a readdir downcall, orangefs_devreq_write_iter() frees\nop->downcall.trailer_buf with vfree() when copy_from_iter_full() fails,\nbut does not clear the pointer before goto Efault. The waiter in\ndo_readdir() is then woken with a negative status and frees the same\npointer again on its r < 0 path, causing a deterministic double-free.\nA client holding /dev/pvfs2-req triggers it by sending a readdir\ndowncall whose declared trailer_size exceeds the bytes it supplies.\n\nClear the pointer after freeing so the readdir-side vfree() becomes a\nno-op.","state":0,"publishedAt":"2026-09-11T19:43:48.096+00:00","modifiedAt":"2026-10-19T08:47:49.902+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/orangefs/devorangefs-req.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"712c4235fcc73c11a2f1d59a499d489e49c374a4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"433c2e470053cc9c712314d3d8c3dfbc862d68eb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"2f5454a25127854c232fde5d1d65d16fbcd42d43\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"f796f38a324e89547738f4b70cc33be5be2bc6da\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"519f4146b8b8c5f20c2ad01913acd6df2df8fc8e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"382f4581e67f57209c7aa67e39f26ba076306a2e\",\n                            \"lessThan\": \"f574296be7f46eb60beca851240b526df232f480\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/orangefs/devorangefs-req.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/712c4235fcc73c11a2f1d59a499d489e49c374a4","https://git.kernel.org/stable/c/433c2e470053cc9c712314d3d8c3dfbc862d68eb","https://git.kernel.org/stable/c/6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad","https://git.kernel.org/stable/c/9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa","https://git.kernel.org/stable/c/2f5454a25127854c232fde5d1d65d16fbcd42d43","https://git.kernel.org/stable/c/f796f38a324e89547738f4b70cc33be5be2bc6da","https://git.kernel.org/stable/c/519f4146b8b8c5f20c2ad01913acd6df2df8fc8e","https://git.kernel.org/stable/c/f574296be7f46eb60beca851240b526df232f480"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89498","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89498","identifiers":["CVE-2026-89498"]},"retained":false,"historicalAffected":[]}],"coverage":[]}