Executive brief
OrangeFS is a parallel filesystem used in distributed storage systems. A bug in the kernel's handling of readdir (directory listing) operations can cause a double-free memory error when a malicious client sends improperly formatted data, potentially leading to kernel crashes or arbitrary code execution on affected systems.
Technical details
A double-free vulnerability exists in the OrangeFS filesystem code within fs/orangefs/devorangefs-req.c. When the orangefs_devreq_write_iter() function processes a readdir downcall and copy_from_iter_full() fails, it frees op->downcall.trailer_buf via vfree() but fails to NULL the pointer before jumping to the error handler. Subsequently, when the waiter in do_readdir() is woken with an error status, it attempts to free the same pointer again, triggering a double-free. A local attacker with access to /dev/pvfs2-req can exploit this by sending a readdir downcall with a declared trailer_size that exceeds the actual bytes supplied. The fix is minimal: set the pointer to NULL after the first vfree() so the second vfree() becomes a safe no-op.
Affected products
- Linux Linux kernel all versions prior to fix commit f574296be7f46eb60beca851240b526df232f480
Timeline
- 2026-09-11: disclosed: CVE-2026-89498 published
- 2026-09-07: patched: Fix committed by Greg Kroah-Hartman