CVE-2026-89497

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

UBUNTU-CVE-2026-89497

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

UBUNTU-CVE-2026-89498

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

EUVD-2026-76404

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498

CVE-2026-89498 affects the orangefs (PVFS2) module in the Linux kernel. On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf via vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error path. The waiter in do_readdir() is...

CVE-2026-89497

A heap buffer overflow exists in the Linux kernel's OrangeFS (orangefs) client, specifically in the function orangefs_prepare_cdm_array(). The function sizes each client debug keyword buffer using strcspn(cds_head, " "), which does not skip leading spaces, but then parses the keyword with the %s ...

CVE-2026-89497 orangefs: skip leading spaces before parsing client debug masks

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

EUVD-2026-76403

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

CVE-2026-89497 orangefs: skip leading spaces before parsing client debug masks

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

CVE-2026-89497

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

CVE-2026-89497: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

PT-2026-90214

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the orangefs component. During a readdir downcall, the function orangefs devreq write iter releases the op-downcall.trailer buf pointer using vfree if copy...

CVE-2026-89498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

PT-2026-96464

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer buf on readdir copy failure On a readdir downcall, orangefs devreq write iter frees op-downcall.trailer buf with vfree when copy from iter full fails, but does not clear the pointer before got...

PT-2026-96368

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs prepare cdm array sizes each client debug keyword buffer with strcspncds head, " ", but then parses the keyword with %s. The %s conversion skips leading...

PT-2026-90213

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow exists in the orangefs component of the Linux kernel during the parsing of client debug masks. The orangefs prepare cdm array function calculates the size of the keywor...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104577)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104577 advisory. In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a...