{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "382f4581e67f57209c7aa67e39f26ba076306a2e"
            },
            {
              "fixed": "712c4235fcc73c11a2f1d59a499d489e49c374a4"
            },
            {
              "fixed": "433c2e470053cc9c712314d3d8c3dfbc862d68eb"
            },
            {
              "fixed": "6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad"
            },
            {
              "fixed": "9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa"
            },
            {
              "fixed": "2f5454a25127854c232fde5d1d65d16fbcd42d43"
            },
            {
              "fixed": "f796f38a324e89547738f4b70cc33be5be2bc6da"
            },
            {
              "fixed": "519f4146b8b8c5f20c2ad01913acd6df2df8fc8e"
            },
            {
              "fixed": "f574296be7f46eb60beca851240b526df232f480"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.12.0"
            },
            {
              "fixed": "5.10.270"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.221"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.188"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89498.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: fix double-free of trailer_buf on readdir copy failure\n\nOn a readdir downcall, orangefs_devreq_write_iter() frees\nop-\u003edowncall.trailer_buf with vfree() when copy_from_iter_full() fails,\nbut does not clear the pointer before goto Efault. The waiter in\ndo_readdir() is then woken with a negative status and frees the same\npointer again on its r \u003c 0 path, causing a deterministic double-free.\nA client holding /dev/pvfs2-req triggers it by sending a readdir\ndowncall whose declared trailer_size exceeds the bytes it supplies.\n\nClear the pointer after freeing so the readdir-side vfree() becomes a\nno-op.",
  "id": "CVE-2026-89498",
  "modified": "2026-09-16T03:30:39.979711008Z",
  "published": "2026-09-11T19:43:48.096Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2f5454a25127854c232fde5d1d65d16fbcd42d43"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/433c2e470053cc9c712314d3d8c3dfbc862d68eb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/519f4146b8b8c5f20c2ad01913acd6df2df8fc8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/712c4235fcc73c11a2f1d59a499d489e49c374a4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f574296be7f46eb60beca851240b526df232f480"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f796f38a324e89547738f4b70cc33be5be2bc6da"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89498.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89498"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "orangefs: fix double-free of trailer_buf on readdir copy failure"
}