CVE-2026-89498

Received Received - Intake

Double-Free in OrangeFS Kernel Module

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89498

EUVD

EUVD-2026-76404

Affected Vendors & Products

Vendor	Product	Version / Range
orangefs	orangefs	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a double-free vulnerability in the Linux kernel's OrangeFS filesystem. It occurs when a client sends a readdir downcall with a trailer_size larger than the data supplied. The kernel frees the same memory buffer twice, once in orangefs_devreq_write_iter() and again in do_readdir(), causing a deterministic crash.

Detection Guidance

This vulnerability is specific to the OrangeFS filesystem in the Linux kernel. Detection requires checking if your system uses OrangeFS and if the kernel version is vulnerable. Inspect loaded kernel modules with lsmod | grep orangefs. Check kernel version with uname -r. If vulnerable, patch or update the kernel immediately.

Impact Analysis

If you use a system with OrangeFS filesystem and have access to /dev/pvfs2-req, an attacker could trigger this flaw to crash the kernel, leading to denial of service. It requires local access but no special privileges.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a double-free issue in the Linux kernel's OrangeFS filesystem driver. The impact is limited to system stability and potential denial-of-service conditions rather than data privacy or security breaches.

Mitigation Strategies

Apply the latest kernel update that patches this issue. If immediate patching is not possible, disable the OrangeFS module by running rmmod orangefs. Ensure no critical services rely on OrangeFS before disabling. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-89498. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70