Riskcovery

CVE-2025-38065

orangefs: Do not truncate file size

State
Published
Severity
7.8 High
Published
Jun 18, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

orangefs: Do not truncate file size

'len' is used to store the result of i_size_read(), so making 'len' a size_t results in truncation to 4GiB on 32-bit systems.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before ceaf195ed285b77791e29016ee6344b3ded609b3Affected
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before 341e3a5984cf5761f3dab16029d7e9fb1641d5ffAffected
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before 5111227d7f1f57f6804666b3abf780a23f44fc1dAffected
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before 15602508ad2f923e228b9521960b4addcd27d9c4Affected
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before 121f0335d91e46369bf55b5da4167d82b099a166Affected
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before cd918ec24168fe08c6aafc077dd3b6d88364c5cfAffected
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before 2323b806221e6268a4e17711bc72e2fc87c191a3Affected
  • f7ab093f74bf638ed98fd1115f3efa17e308bb7f to before 062e8093592fb866b8e016641a8b27feb6ac509dAffected
LinuxLinux
  • 4.6Affected
  • before 4.6Not affected
  • 5.4.294 through 5.4.*Not affected
  • 5.10.238 through 5.10.*Not affected
  • 5.15.185 through 5.15.*Not affected
  • 6.1.141 through 6.1.*Not affected
  • 6.6.93 through 6.6.*Not affected
  • 6.12.31 through 6.12.*Not affected
  • 6.14.9 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.