The vulnerability resides in the Linux kernel’s orangefs filesystem driver, where a readdir operation can trigger a double‑free of the trailer buffer when copy_from_iter_full() fails. The first free occurs in orangefs_devreq_write_iter(), but the pointer is not cleared before control flows to error handling; later, do_readdir() frees the same pointer again. This deterministic double‑free is a classic example of CWE‑763 (Improper Memory Management) and can corrupt kernel heap memory, potentially allowing an attacker to execute arbitrary code or crash the system.

All Linux kernel releases that include the orangefs module are affected, as the flaw exists in the kernel source shared by all vendors. A client that can access /dev/pvfs2-req—typically a local user with appropriate permissions—can trigger the issue by issuing a readdir downcall with a trailer_size larger than the actual data supplied.

The CVSS score of 4.1 indicates low severity, while the EPSS score of less than 1% suggests a very small probability of exploitation in the wild. The bug is not listed. The exploitation vector is local: an attacker must have privileges sufficient to perform the malicious readdir operation on /dev/pvfs2-req. Because the double‑free is deterministic but would still require additional steps to achieve arbitrary code execution, the overall risk for typical deployments is modest, though denial of service can immediately affect affected systems.