CVE-2026-72033orangefs: keep the readdir entry size 64-bit in fill_from_part()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill_from_part() fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel. Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 480e3e532e31666a18520a7964bb4095d7a16b9a before 1679780f482feeb82acb5995587d4fb1d1fe82fd; from 480e3e532e31666a18520a7964bb4095d7a16b9a before a72bbb43689591c9d36e3bb45c2d4e688cf92682; from 480e3e532e31666a18520a7964bb4095d7a16b9a before 36723b28e3293047f087f4501f1ef4ead418dd84; 480e3e532e31666a18520a7964bb4095d7a16b9a builds before 07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9; from 480e3e532e31666a18520a7964bb4095d7a16b9a before fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1; 480e3e532e31666a18520a7964bb4095d7a16b9a builds before 82fc886e244c76fadf05ef1958aaf8815478ccde; from 480e3e532e31666a18520a7964bb4095d7a16b9a before e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729; from 480e3e532e31666a18520a7964bb4095d7a16b9a before 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc | CNA record |
References
- https://git.kernel.org/stable/c/1679780f482feeb82acb5995587d4fb1d1fe82fd
- https://git.kernel.org/stable/c/a72bbb43689591c9d36e3bb45c2d4e688cf92682
- https://git.kernel.org/stable/c/36723b28e3293047f087f4501f1ef4ead418dd84
- https://git.kernel.org/stable/c/07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9
- https://git.kernel.org/stable/c/fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1
- https://git.kernel.org/stable/c/82fc886e244c76fadf05ef1958aaf8815478ccde
- https://git.kernel.org/stable/c/e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729
- https://git.kernel.org/stable/c/18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.