orangefs: fix double-free of trailer_buf on readdir copy failure

Summary

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.

Timeline

1. Sep 11, 2026, 7:43 PM UTCCVE published
2. Oct 19, 2026, 8:47 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in 712c4235fcc73c11a2f1d59a499d489e49c374a4; From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in 433c2e470053cc9c712314d3d8c3dfbc862d68eb; From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in 6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad; From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in 9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa; From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in 2f5454a25127854c232fde5d1d65d16fbcd42d43; From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in f796f38a324e89547738f4b70cc33be5be2bc6da; From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in 519f4146b8b8c5f20c2ad01913acd6df2df8fc8e; From 382f4581e67f57209c7aa67e39f26ba076306a2e · fixed in f574296be7f46eb60beca851240b526df232f480

• Linux Linux

  4.12

• KernelLinux

  From 4.12.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4

References 8