{"id":"CVE-2026-89497","title":"orangefs: skip leading spaces before parsing client debug masks","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: skip leading spaces before parsing client debug masks\n\norangefs_prepare_cdm_array() sizes each client debug keyword buffer\nwith strcspn(cds_head, \" \"), but th…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 173bfd69696815bcf1c052f61cb69c26cca4e443","Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 995f4d05589f87452a56672270af28918c8939c3","Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 0ef38d53bca5ea1375fea0d3d11e9727df064b85","Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < ce748ae1181d0daf5dd0d2d906d5c1cc328c153b","Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 15d79c806231e62a7b746d3b42626810004e1b27","Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 116d14f29a0524853c9316f32a2ac06cff5d4bf6","Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 1774c5b3713add32fe15ab0d3db4b73355f94e35","Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < d410cd5303ec59c7cf23dd61423752ce8e9ecb59","Linux 4.6"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T12:00:32.105Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89497","references":[{"url":"https://git.kernel.org/stable/c/173bfd69696815bcf1c052f61cb69c26cca4e443"},{"url":"https://git.kernel.org/stable/c/995f4d05589f87452a56672270af28918c8939c3"},{"url":"https://git.kernel.org/stable/c/0ef38d53bca5ea1375fea0d3d11e9727df064b85"},{"url":"https://git.kernel.org/stable/c/ce748ae1181d0daf5dd0d2d906d5c1cc328c153b"},{"url":"https://git.kernel.org/stable/c/15d79c806231e62a7b746d3b42626810004e1b27"},{"url":"https://git.kernel.org/stable/c/116d14f29a0524853c9316f32a2ac06cff5d4bf6"},{"url":"https://git.kernel.org/stable/c/1774c5b3713add32fe15ab0d3db4b73355f94e35"},{"url":"https://git.kernel.org/stable/c/d410cd5303ec59c7cf23dd61423752ce8e9ecb59"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02901,"ingestedAt":"2026-09-14T15:23:07.452Z","slug":"CVE-2026-89497","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\norangefs: skip leading spaces before parsing client debug masks\n\norangefs_prepare_cdm_array() sizes each client debug keyword buffer\nwith strcspn(cds_head, \" \"), but then parses the keyword with %s. The\n%s conversion skips leading whitespace, while strcspn() does not.\n\nIf a client debug entry starts with a space, the allocation can be sized\nfor an empty keyword while sscanf() copies the following non-empty token.\nThis can write past the end of the allocated keyword buffer.\n\nSkip leading spaces before computing the keyword length so the allocation\nmatches the string parsed by sscanf().\n\n## Affected\n\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 173bfd69696815bcf1c052f61cb69c26cca4e443`\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 995f4d05589f87452a56672270af28918c8939c3`\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 0ef38d53bca5ea1375fea0d3d11e9727df064b85`\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < ce748ae1181d0daf5dd0d2d906d5c1cc328c153b`\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 15d79c806231e62a7b746d3b42626810004e1b27`\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 116d14f29a0524853c9316f32a2ac06cff5d4bf6`\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < 1774c5b3713add32fe15ab0d3db4b73355f94e35`\n- `Linux >= f7be4ee07fb72a516563bc2870ef41fa589a964a < d410cd5303ec59c7cf23dd61423752ce8e9ecb59`\n- `Linux 4.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":198000,"id":"CVE-2026-89497","ts":1789384321320,"field":"cvss","old":"5.6","new":"7.8"},{"seq":197999,"id":"CVE-2026-89497","ts":1789384321320,"field":"severity","old":"medium","new":"high"},{"seq":183516,"id":"CVE-2026-89497","ts":1789356675687,"field":"cvss","old":"7.8","new":"5.6"},{"seq":183515,"id":"CVE-2026-89497","ts":1789356675687,"field":"severity","old":"high","new":"medium"},{"seq":153286,"id":"CVE-2026-89497","ts":1789285349889,"field":"cvss","old":null,"new":"7.8"},{"seq":153285,"id":"CVE-2026-89497","ts":1789285349889,"field":"severity","old":"none","new":"high"},{"seq":109624,"id":"CVE-2026-89497","ts":1789183732690,"field":"cvss","old":null,"new":"5.6"},{"seq":109623,"id":"CVE-2026-89497","ts":1789183732690,"field":"severity","old":"none","new":"medium"}]}