CVE-2026-89498 Overview
CVE-2026-89498 is a double-free vulnerability in the Linux kernel's OrangeFS client. The flaw resides in the orangefs_devreq_write_iter() function, which handles downcalls from userspace clients holding /dev/pvfs2-req. When copy_from_iter_full() fails during a readdir downcall, the kernel calls vfree() on op->downcall.trailer_buf but does not clear the pointer. The waiter in do_readdir() then wakes with a negative status and calls vfree() on the same pointer, producing a deterministic double-free of kernel memory.
Critical Impact
A local user with access to /dev/pvfs2-req can trigger deterministic kernel memory corruption by sending a crafted readdir downcall whose declared trailer_size exceeds the bytes supplied.
Affected Products
- Linux kernel with OrangeFS filesystem support (fs/orangefs)
- Systems mounting OrangeFS via the pvfs2-client userspace daemon
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89498 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89498
Vulnerability Analysis
The OrangeFS kernel client communicates with a userspace daemon over the /dev/pvfs2-req character device. Userspace responses, called downcalls, are written to the device and processed by orangefs_devreq_write_iter(). For readdir operations, the downcall carries a variable-length trailer buffer allocated with vmalloc() and referenced by op->downcall.trailer_buf.
When copy_from_iter_full() fails to copy the declared trailer bytes, the write handler frees trailer_buf with vfree() and jumps to the Efault label without clearing the pointer. The waiting thread in do_readdir() is woken with a negative status. On its error path (r < 0), it calls vfree() on the same non-NULL pointer, triggering a double-free [CWE-415].
Root Cause
The root cause is a missing pointer clear after vfree() in the failure path of the readdir downcall write handler. Ownership of trailer_buf is shared between the writer thread and the waiter thread through the op structure, but the failure path does not enforce a single owner. The fix sets op->downcall.trailer_buf = NULL after freeing, which makes the subsequent vfree(NULL) in the waiter a no-op.
Attack Vector
Exploitation requires local access to /dev/pvfs2-req, typically held by the pvfs2-client userspace daemon. A process with that handle sends a readdir downcall whose declared trailer_size exceeds the actual bytes provided in the iterator. The short write forces copy_from_iter_full() to fail, triggering the vulnerable free path. Because the double-free path is deterministic, the condition can be reached reliably without race tuning.
No public exploit code is available for CVE-2026-89498. The vulnerability is described in prose only; see the referenced upstream commits for the exact patched call sites.
Detection Methods for CVE-2026-89498
Indicators of Compromise
- Kernel log entries containing double free or BUG: KASAN: double-free referencing vfree and orangefs
- Unexpected kernel panics or oopses in orangefs_devreq_write_iter or do_readdir call stacks
- Unprivileged or unexpected processes opening /dev/pvfs2-req outside the sanctioned pvfs2-client daemon
Detection Strategies
- Enable CONFIG_SLUB_DEBUG and KASAN on test kernels to surface the double-free at the point of the second vfree() call
- Audit installed kernel package versions against the upstream fix commits 2f5454a, 433c2e4, 519f414, 6e59246, 712c423, 9c9eacc, f574296, and f796f38
- Monitor for OrangeFS mounts on hosts that do not require distributed filesystem access
Monitoring Recommendations
- Forward kernel ring buffer (dmesg, journalctl -k) to a central log store and alert on orangefs fault signatures
- Track process access to /dev/pvfs2-req using auditd rules on open and write syscalls
- Alert on unexpected kernel module loads for orangefs.ko on hosts without an OrangeFS workload
How to Mitigate CVE-2026-89498
Immediate Actions Required
- Apply the stable kernel update that includes the referenced OrangeFS fix commits from your distribution vendor
- Unmount OrangeFS filesystems and stop the pvfs2-client daemon on hosts that do not require distributed filesystem functionality
- Restrict access to /dev/pvfs2-req to the dedicated OrangeFS service account only
Patch Information
The upstream fix clears op->downcall.trailer_buf immediately after vfree() in orangefs_devreq_write_iter(), making the subsequent free in do_readdir() a no-op. The fix is committed across multiple stable branches. Reference the following upstream commits: Kernel Commit 2f5454a, Kernel Commit 433c2e4, Kernel Commit 519f414, Kernel Commit 6e59246, Kernel Commit 712c423, Kernel Commit 9c9eacc, Kernel Commit f574296, and Kernel Commit f796f38.
Workarounds
- Blacklist the orangefs kernel module on hosts that do not require OrangeFS to prevent load of the vulnerable code path
- Enforce strict permissions on /dev/pvfs2-req so only the trusted pvfs2-client process can open the device
- Remove or disable the OrangeFS userspace client package where the filesystem is not in production use
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
