In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir… (CVE-2026-89498)
A double-free vulnerability in the Linux kernel's orangefs module was fixed. The flaw occurs when a readdir downcall fails during a copy operation, leading to the same memory pointer being freed twice. This happens because the pointer is not cleared after the first free, causing a deterministic double-free when the error path is followed. The issue can be triggered by a client sending a readdir downcall with a trailer size larger than the supplied bytes. The fix clears the pointer after freeing it to prevent the second free operation.
AI Analysis
Technical Summary
The Linux kernel's orangefs module had a double-free vulnerability (CVE-2026-89498) caused by improper handling of the trailer_buf pointer during a readdir downcall failure. Specifically, orangefs_devreq_write_iter() frees trailer_buf with vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error handling code. Subsequently, the waiter in do_readdir() frees the same pointer again on its error path, causing a deterministic double-free. This can be triggered by a client holding /dev/pvfs2-req sending a readdir downcall with a declared trailer_size exceeding the actual bytes supplied. The patch clears the pointer after the first free to prevent the double-free.
Potential Impact
The vulnerability leads to a deterministic double-free condition in kernel memory management, which can cause kernel instability or crashes. While the input data does not specify exploitation details, double-free bugs in kernel code can potentially be leveraged for denial of service or privilege escalation if exploited.
Mitigation Recommendations
A fix has been applied that clears the trailer_buf pointer after freeing it, preventing the double-free. Users should update to the patched Linux kernel version containing this fix. No additional mitigation steps are indicated in the provided data.
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir… (CVE-2026-89498)
Description
A double-free vulnerability in the Linux kernel's orangefs module was fixed. The flaw occurs when a readdir downcall fails during a copy operation, leading to the same memory pointer being freed twice. This happens because the pointer is not cleared after the first free, causing a deterministic double-free when the error path is followed. The issue can be triggered by a client sending a readdir downcall with a trailer size larger than the supplied bytes. The fix clears the pointer after freeing it to prevent the second free operation.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's orangefs module had a double-free vulnerability (CVE-2026-89498) caused by improper handling of the trailer_buf pointer during a readdir downcall failure. Specifically, orangefs_devreq_write_iter() frees trailer_buf with vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error handling code. Subsequently, the waiter in do_readdir() frees the same pointer again on its error path, causing a deterministic double-free. This can be triggered by a client holding /dev/pvfs2-req sending a readdir downcall with a declared trailer_size exceeding the actual bytes supplied. The patch clears the pointer after the first free to prevent the double-free.
Potential Impact
The vulnerability leads to a deterministic double-free condition in kernel memory management, which can cause kernel instability or crashes. While the input data does not specify exploitation details, double-free bugs in kernel code can potentially be leveraged for denial of service or privilege escalation if exploited.
Mitigation Recommendations
A fix has been applied that clears the trailer_buf pointer after freeing it, preventing the double-free. Users should update to the patched Linux kernel version containing this fix. No additional mitigation steps are indicated in the provided data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9g9c-4vjc-cw83
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89498"]
Threat ID: 6aa4a01755bf5e2cf5a866f3
Added to database: 09/12/2026, 00:43:03 UTC
Last enriched: 09/12/2026, 01:12:31 UTC
Last updated: 09/12/2026, 01:12:31 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.