CVE-2026-72033

orangefs: keep the readdir entry size 64-bit in fill_from_part()

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

orangefs: keep the readdir entry size 64-bit in fill_from_part()

fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel.

Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	480e3e532e31666a18520a7964bb4095d7a16b9a to before 1679780f482feeb82acb5995587d4fb1d1fe82fdAffected 480e3e532e31666a18520a7964bb4095d7a16b9a to before a72bbb43689591c9d36e3bb45c2d4e688cf92682Affected 480e3e532e31666a18520a7964bb4095d7a16b9a to before 36723b28e3293047f087f4501f1ef4ead418dd84Affected 480e3e532e31666a18520a7964bb4095d7a16b9a to before 07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9Affected 480e3e532e31666a18520a7964bb4095d7a16b9a to before fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1Affected 480e3e532e31666a18520a7964bb4095d7a16b9a to before 82fc886e244c76fadf05ef1958aaf8815478ccdeAffected 480e3e532e31666a18520a7964bb4095d7a16b9a to before e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729Affected 480e3e532e31666a18520a7964bb4095d7a16b9a to before 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfcAffected
LinuxLinux	4.12Affected before 4.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

480e3e532e31666a18520a7964bb4095d7a16b9a to before 1679780f482feeb82acb5995587d4fb1d1fe82fdAffected
480e3e532e31666a18520a7964bb4095d7a16b9a to before a72bbb43689591c9d36e3bb45c2d4e688cf92682Affected
480e3e532e31666a18520a7964bb4095d7a16b9a to before 36723b28e3293047f087f4501f1ef4ead418dd84Affected
480e3e532e31666a18520a7964bb4095d7a16b9a to before 07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9Affected
480e3e532e31666a18520a7964bb4095d7a16b9a to before fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1Affected
480e3e532e31666a18520a7964bb4095d7a16b9a to before 82fc886e244c76fadf05ef1958aaf8815478ccdeAffected
480e3e532e31666a18520a7964bb4095d7a16b9a to before e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729Affected
480e3e532e31666a18520a7964bb4095d7a16b9a to before 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfcAffected

LinuxLinux

4.12Affected
before 4.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.