« Volver al listado

CVE-2026-89498

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

orangefs: fix double-free of trailer_buf on readdir copy failure

On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies.

Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89498",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "712c4235fcc73c11a2f1d59a499d489e49c374a4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "433c2e470053cc9c712314d3d8c3dfbc862d68eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "2f5454a25127854c232fde5d1d65d16fbcd42d43",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "f796f38a324e89547738f4b70cc33be5be2bc6da",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "519f4146b8b8c5f20c2ad01913acd6df2df8fc8e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "lessThan": "f574296be7f46eb60beca851240b526df232f480",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/orangefs/devorangefs-req.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/orangefs/devorangefs-req.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:31.940",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2f5454a25127854c232fde5d1d65d16fbcd42d43",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/433c2e470053cc9c712314d3d8c3dfbc862d68eb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/519f4146b8b8c5f20c2ad01913acd6df2df8fc8e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/712c4235fcc73c11a2f1d59a499d489e49c374a4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f574296be7f46eb60beca851240b526df232f480",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f796f38a324e89547738f4b70cc33be5be2bc6da",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: fix double-free of trailer_buf on readdir copy failure\n\nOn a readdir downcall, orangefs_devreq_write_iter() frees\nop->downcall.trailer_buf with vfree() when copy_from_iter_full() fails,\nbut does not clear the pointer before goto Efault. The waiter in\ndo_readdir() is then woken with a negative status and frees the same\npointer again on its r < 0 path, causing a deterministic double-free.\nA client holding /dev/pvfs2-req triggers it by sending a readdir\ndowncall whose declared trailer_size exceeds the bytes it supplies.\n\nClear the pointer after freeing so the readdir-side vfree() becomes a\nno-op."
    }
  ],
  "lastModified": "2026-09-14T13:19:07.087",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}