{"id":"AZL-100181","summary":"CVE-2026-89497 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: skip leading spaces before parsing client debug masks\n\norangefs_prepare_cdm_array() sizes each client debug keyword buffer\nwith strcspn(cds_head, \" \"), but then parses the keyword with %s. The\n%s conversion skips leading whitespace, while strcspn() does not.\n\nIf a client debug entry starts with a space, the allocation can be sized\nfor an empty keyword while sscanf() copies the following non-empty token.\nThis can write past the end of the allocated keyword buffer.\n\nSkip leading spaces before computing the keyword length so the allocation\nmatches the string parsed by sscanf().","modified":"2026-09-13T06:06:36Z","published":"2026-09-11T20:19:31Z","upstream":["CVE-2026-89497"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89497"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100181.json"}}],"schema_version":"1.9.0"}