CVE-2026-89498

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498

CVE-2026-89498 affects the orangefs (PVFS2) module in the Linux kernel. On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf via vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error path. The waiter in do_readdir() is...

EUVD-2026-76404

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...