CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

EUVD-2026-76404

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498

CVE-2026-89498 affects the orangefs (PVFS2) module in the Linux kernel. On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf via vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error path. The waiter in do_readdir() is...

CVE-2026-89490 ocfs2: fix readdir position truncation on 32-bit kernels

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89490

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

EUVD-2026-76396

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89490 ocfs2: fix readdir position truncation on 32-bit kernels

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89490

CVE-2026-89490 affects the ocfs2 filesystem in the Linux kernel on 32-bit systems. In ocfs2_dir_foreach_blk_el(), the directory position mask derived from sb->s_blocksize (a 32-bit unsigned long) is zero-extended to 64 bits when ANDed with the loff_t-typed ctx->pos, silently clearing the hi...

PT-2026-90214

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer buf on readdir copy failure On a readdir downcall, orangefs devreq write iter frees op-downcall.trailer buf with vfree when copy from iter full fails, but does not clear the pointer before got...

PT-2026-90206

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2 dir foreach blk el, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-s blocksize - 1 | offset; ctx-pos is loff t signed 64-bit, while sb-s...

CVE-2026-89490: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2dirforeachblkel, the directory cookie position is rebuilt with ctx-pos = ctx-pos & sb-sblocksize - 1 | offset; ctx-pos is lofft signed 64-bit, while sb-sblocksize i...

CVE-2026-89498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

Unity Linux 20.1070e Security Update: gawk (UTSA-2026-104948)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104948 advisory. Buffer overflow vulnerability has been found in extension/readdir.c program file of gawk ftyperoutine. This issue could be used to crash the program and potentially ...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098683)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098683 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifsfilldirent There is a race condition in the readdir...

CVE-2026-40553

A flaw was found in gawk. A buffer overflow vulnerability exists in the ftype routine, located in the extension/readdir.c program file. This vulnerability could allow an attacker to crash the program, resulting in a denial of service. It may also potentially lead to arbitrary code execution, thou...

SUSE SLED15 / SLES15 Security Update : gawk (SUSE-SU-2026:3455-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3455-1 advisory. - CVE-2026-40467: use-after-free in the io.c program file via the dogetlineredir routine bsc1271351. -...

gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service

A flaw was found in gawk. A buffer overflow vulnerability exists in the ftype routine, located in the extension/readdir.c program file. This vulnerability could allow an attacker to crash the program, resulting in a denial of service. It may also potentially lead to arbitrary code execution, thou...

GO-2026-5051 Out-of-bounds read and panic in ReadDir in github.com/cloudsoda/go-smb2 and github.com/hirochachacha/go-smb2

ReadDir and ReadDirPlus parse the QUERYDIRECTORY SMB response by advancing through entries using the server-supplied NextEntryOffset field. The pre-fix code does not bound next against the remaining buffer before re-slicing, and the entry decoder IsInvalid check performs length arithmetic in int...