CVE-2026-89498

In the Linux kernel, the following vulnerability has been resolved:

orangefs: fix double-free of trailer buf on readdir copy failure

On a readdir downcall, orangefs devreq write iter() frees op->downcall.trailer buf with vfree() when copy from iter full() fails, but does not clear the pointer before goto Efault. The waiter in do readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer size exceeds the bytes it supplies.

Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.