orangefs: fix double-free of trailer_buf on readdir copy failure
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.270, 5.15.221, 6.1.188, 6.12.109, 6.18.50, 6.6.157, 7.2.4
- CVEs
- CVE-2026-89498
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:42 UTC · Revision 1
Source evidence
orangefs: fix double-free of trailer_buf on readdir copy failure
core-osv · Original sourcePublished 11 Sept 2026, 19:43 UTC
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.
osv:CVE-2026-89498
Kernel
Fixed versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
Complete source record
{
"id": "97662edc1a7dad0ea747b00314d7f557e811f7b023708a87c2fcae8454536f04",
"url": "https://osv.dev/vulnerability/CVE-2026-89498",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "orangefs: fix double-free of trailer_buf on readdir copy failure",
"summary": "In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.",
"evidence": "osv:CVE-2026-89498",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.270",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.221",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.188",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.157",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.109",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.50",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.4",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-89498",
"aliases": [
"CVE-2026-89498"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "382f4581e67f57209c7aa67e39f26ba076306a2e"
},
{
"fixed": "712c4235fcc73c11a2f1d59a499d489e49c374a4"
},
{
"fixed": "433c2e470053cc9c712314d3d8c3dfbc862d68eb"
},
{
"fixed": "6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad"
},
{
"fixed": "9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa"
},
{
"fixed": "2f5454a25127854c232fde5d1d65d16fbcd42d43"
},
{
"fixed": "f796f38a324e89547738f4b70cc33be5be2bc6da"
},
{
"fixed": "519f4146b8b8c5f20c2ad01913acd6df2df8fc8e"
},
{
"fixed": "f574296be7f46eb60beca851240b526df232f480"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89498.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.12.0"
},
{
"fixed": "5.10.270"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.221"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.188"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.157"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.109"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.50"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.4"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89498.json"
}
}
],
"modified": "2026-10-28T02:30:25.118198824Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/2f5454a25127854c232fde5d1d65d16fbcd42d43",
"https://git.kernel.org/stable/c/433c2e470053cc9c712314d3d8c3dfbc862d68eb",
"https://git.kernel.org/stable/c/519f4146b8b8c5f20c2ad01913acd6df2df8fc8e",
"https://git.kernel.org/stable/c/6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad",
"https://git.kernel.org/stable/c/712c4235fcc73c11a2f1d59a499d489e49c374a4",
"https://git.kernel.org/stable/c/9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa",
"https://git.kernel.org/stable/c/f574296be7f46eb60beca851240b526df232f480",
"https://git.kernel.org/stable/c/f796f38a324e89547738f4b70cc33be5be2bc6da",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89498.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-89498",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89498.json"
}
},
"related_cves": [
{
"value": "CVE-2026-89498",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 491706,
"published_at": "2026-09-11T19:43:48.096+00:00"
}