CVE-2026-89498

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

orangefs: fix double-free of trailer_buf on readdir copy failure

On a readdir downcall, orangefs_devreq_write_iter() frees

op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails,

but does not clear the pointer before goto Efault. The waiter in

do_readdir() is then woken with a negative status and frees the same

pointer again on its r < 0 path, causing a deterministic double-free.

A client holding /dev/pvfs2-req triggers it by sending a readdir

downcall whose declared trailer_size exceeds the bytes it supplies.

Clear the pointer after freeing so the readdir-side vfree() becomes a

no-op.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References