CVE-2026-89497

The Linux kernel's OrangeFS client driver contains a heap buffer overflow in orangefs_prepare_cdm_array(), which sizes each client debug keyword buffer with strcspn(cds_head, " ") — a function that stops at the first space but does not skip leading whitespace — while the subsequent sscanf() %s conversion does skip leading whitespace. If a client debug entry begins with a space, the kernel allocates a buffer sized for an empty keyword and then copies the following non-empty token past the end of that allocation. A local low-privileged attacker who can set the OrangeFS client debug mask can trigger kernel heap memory corruption, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8), plausibly enabling local privilege escalation or a denial-of-service via kernel panic. Only systems running kernels with the OrangeFS client driver (CONFIG_ORANGEFS_FS) enabled and the module loaded — primarily HPC clusters using OrangeFS/PVFS2 — are affected; note that the debug interface is typically restricted to privileged users, which further limits practical exploitability. No public proof-of-concept exists and the flaw is not known to be exploited in the wild.

What to do: Apply a kernel update containing the upstream fix, which skips leading spaces before computing the keyword length so the allocation matches what sscanf() parses. Until patched, restrict writes to the OrangeFS client debug settings (module parameter/sysfs interface) to trusted administrators, and unload or blacklist the orangefs module on any system that does not need to mount the filesystem. Review kernel logs on OrangeFS-enabled nodes for crashes or faults in orangefs debug parsing.