Executive brief
The Linux kernel's orangefs file system debug interface contains a buffer overflow vulnerability when parsing client debug settings. An attacker with local access to the debug interface can provide specially crafted input with leading spaces to cause a heap buffer overflow, potentially allowing code execution or system crash.
Technical details
The vulnerability is a heap buffer overflow in the orangefs_prepare_cdm_array() function in fs/orangefs/orangefs-debugfs.c. The vulnerable code uses strcspn() to calculate buffer size for a keyword (which does not skip leading whitespace) but then parses the same input with sscanf() using the %s conversion (which does skip leading whitespace). If debug input starts with a space, the allocation is sized for an empty keyword while sscanf() writes a non-empty token, overwriting heap memory past the buffer boundary. The fix adds skip_spaces() before computing keyword length to align allocation with actual parsing behavior. Local access to the debugfs interface is required; exploitation results in heap corruption leading to DoS or potential code execution.
Affected products
- Linux Linux kernel multiple versions with orangefs driver; patch commit d410cd5303ec59c7cf23dd61423752ce8e9ecb59
Timeline
- 2026-09-11: disclosed: CVE-2026-89497 published
- 2026-09-14: patched: Fix merged to Linux kernel stable tree
- 2026-07-24: other: Vulnerability reported by Vega