CVE-2026-89497

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The overflow is reached only via ioctl(ORANGEFS_DEV_CLIENT_STRING) on /dev/pvfs2-req after orangefs_devreq_open(); orangefs_debugfs_new_client_string() copy_from_user()s the client debug-mask table from that local fd into orangefs_prepare_cdm_array(). Unlike readdir trailers, this string is not supplied by an OrangeFS server over the network.

AC:LAttack complexity, low

A single CLIENT_STRING ioctl whose first newline-delimited entry begins with spaces then a long non-whitespace token deterministically makes strcspn() return 0 while sscanf("%s") copies that token; the attacker fully controls the 2048-byte buffer and needs no race, heap layout, or other state outside their control.

PR:LPrivileges required, low

orangefs_devreq_open() checks only init_user_ns, O_NONBLOCK, and exclusive open—no capability. The kernel documents mknod /dev/pvfs2-req, which is typically world-readable, and ioctl works on O_RDONLY, so an unprivileged local user can open the node when client-core is not holding it; user namespaces cannot open it, but init-ns DAC is enough.

UI:NUser interaction, none

The attacker opens /dev/pvfs2-req and issues the crafted CLIENT_STRING ioctl themselves. No victim must mount OrangeFS, start pvfs2-client-core, or otherwise interact; an already-loaded module and device node are deployment state, not user interaction.

S:UScope, unchanged

The heap overflow and any resulting kernel memory corruption or oops occur in the same kernel that services the ioctl. This is a standard local kernel compromise, not a VM/IOMMU/sandbox boundary crossing.

C:HConfidentiality impact, high

sscanf("%s") with no field width copies an attacker-chosen token (up to the 2048-byte ioctl buffer) into a kzalloc(1) keyword, a large heap overflow that can overwrite adjacent slab objects and pointers, yielding an arbitrary read primitive per CNA memory-corruption guidance.

I:HIntegrity impact, high

The same unbounded out-of-bounds write smashes heap metadata and neighboring objects with attacker-controlled bytes, which is sufficient for arbitrary write and control-flow hijack; CNA guidance rates heap buffer overflows High for integrity.

A:HAvailability impact, high

Overflowing a 1-byte slab allocation by up to ~2KB of attacker data reliably corrupts the heap and can oops/panic the kernel even without a full exploit, so availability impact is High.