Log in Start free

Vulnerability · Published Sep 11, 2026 · Assigned by Linux

CVE-2026-89497orangefs: skip leading spaces before parsing client debug masks

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 97.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " "), but then parses the keyword with %s. The %s conversion skips leading whitespace, while strcspn() does not. If a client debug entry starts with a space, the allocation can be sized for an empty keyword while sscanf() copies the following non-empty token. This can write past the end of the allocated keyword buffer. Skip leading spaces before computing the keyword length so the allocation matches the string parsed by sscanf().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.190-1DEBIAN-CVE-2026-89497
Debian:13linux6.12.111-1DEBIAN-CVE-2026-89497
Debian:14linux7.2.6-1DEBIAN-CVE-2026-89497
Debian:12linux-6.126.12.111-1~deb12u1DEBIAN-CVE-2026-89497
Ubuntu:22.04:LTSlinux5.15.0-202.212UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux7.0.0-42.42UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-aws5.15.0-1119.126UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure5.15.0-1125.134UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1124.133UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-gcp5.15.0-1120.130UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-gke5.15.0-1115.121UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1102.110UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-ibm5.15.0-1113.117UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1114.120UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-kvm5.15.0-1111.116UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-197.207UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1114.115UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1070.72UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1038.42UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1059.59UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-oracle5.15.0-1116.122UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16UBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-89497
Ubuntu:26.04:LTSlinux-riscv7.0.0-42.42.1UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-42.42.1~24.04.1UBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-vmwareno fix listedUBUNTU-CVE-2026-89497
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-89497
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2026-89497

Affected products (as reported)

VendorProductVersions
Linux Linux f7be4ee07fb72a516563bc2870ef41fa589a964a – before 173bfd69696815bcf1c052f61cb69c26cca4e443f7be4ee07fb72a516563bc2870ef41fa589a964a – before 995f4d05589f87452a56672270af28918c8939c3f7be4ee07fb72a516563bc2870ef41fa589a964a – before 0ef38d53bca5ea1375fea0d3d11e9727df064b85f7be4ee07fb72a516563bc2870ef41fa589a964a – before ce748ae1181d0daf5dd0d2d906d5c1cc328c153bf7be4ee07fb72a516563bc2870ef41fa589a964a – before 15d79c806231e62a7b746d3b42626810004e1b27f7be4ee07fb72a516563bc2870ef41fa589a964a – before 116d14f29a0524853c9316f32a2ac06cff5d4bf6f7be4ee07fb72a516563bc2870ef41fa589a964a – before 1774c5b3713add32fe15ab0d3db4b73355f94e35f7be4ee07fb72a516563bc2870ef41fa589a964a – before d410cd5303ec59c7cf23dd61423752ce8e9ecb59
Linux Linux 4.6

References