CVE-2026-72033 (GCVE-0-2026-72033)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
orangefs: keep the readdir entry size 64-bit in fill_from_part()
Summary
In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill_from_part() fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel. Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < 1679780f482feeb82acb5995587d4fb1d1fe82fd (git)
Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < a72bbb43689591c9d36e3bb45c2d4e688cf92682 (git)
Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < 36723b28e3293047f087f4501f1ef4ead418dd84 (git)
Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < 07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9 (git)
Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1 (git)
Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < 82fc886e244c76fadf05ef1958aaf8815478ccde (git)
Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729 (git)
Affected: 480e3e532e31666a18520a7964bb4095d7a16b9a , < 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/orangefs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1679780f482feeb82acb5995587d4fb1d1fe82fd",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            },
            {
              "lessThan": "a72bbb43689591c9d36e3bb45c2d4e688cf92682",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            },
            {
              "lessThan": "36723b28e3293047f087f4501f1ef4ead418dd84",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            },
            {
              "lessThan": "07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            },
            {
              "lessThan": "fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            },
            {
              "lessThan": "82fc886e244c76fadf05ef1958aaf8815478ccde",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            },
            {
              "lessThan": "e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            },
            {
              "lessThan": "18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc",
              "status": "affected",
              "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/orangefs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: keep the readdir entry size 64-bit in fill_from_part()\n\nfill_from_part() computes the size of a directory entry in size_t but\nstores it in a __u32. An entry length near U32_MAX wraps it to a small\nvalue, bypasses the bounds check, and is then used to index the entry,\nreading far past the directory part -- an out-of-bounds read that oopses\nthe kernel.\n\nCompute the size as a u64 so it cannot truncate; the bounds check then\nrejects the entry. The trailer is supplied by the userspace client."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fill_from_part() parses readdir trailer bytes relayed by pvfs2-client-core from an OrangeFS/PVFS server over the cluster network; a malicious or compromised server can supply crafted directory-entry lengths that reach the kernel during getdents on HPC client nodes without local shell access.\nAC:L - An entry length near U32_MAX makes padlen truncate to a small __u32, reliably bypassing the bounds check and forcing the subsequent s[*len] probe; the attacker fully controls the trailer fields and no race, heap layout, or timing condition beyond readdir is required.\nPR:N - A remote malicious OrangeFS/PVFS metadata server needs no account, capabilities, or namespaces on victim HPC compute nodes; once clients mount the filesystem, any process with directory read access can trigger parsing of attacker-supplied trailer bytes.\nUI:N - No victim interaction is required beyond normal automated directory scans (cron, parallel job launchers, monitoring); the attacker does not need a user to mount the filesystem or click anything\u2014only pre-existing cluster mounts to the compromised server.\nS:U - The out-of-bounds read and resulting kernel oops occur entirely within the victim client\u0027s kernel address space during VFS readdir processing; there is no inherent crossing of VM, container, IOMMU, or sandbox security boundaries.\nC:H - The integer truncation lets the kernel index gigabytes past the vzalloc readdir part buffer via s[*len], an unbounded out-of-bounds read over adjacent kernel memory before the fault; per CNA guidance OOB reads of this class are rated High.\nI:H - The bounds bypass is a memory-corruption class flaw that can reach beyond the allocated directory part into adjacent kernel heap; even though the immediate access is a read, CNA guidance rates such unchecked OOB probes as High integrity impact due to exploit chaining potential.\nA:H - The maintainer confirmed the out-of-bounds read oopses the kernel; the inflated index can touch unmapped pages far outside the PART_SIZE-limited trailer buffer, causing a kernel fault, panic, or node crash on HPC clients during routine readdir."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:36.089Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1679780f482feeb82acb5995587d4fb1d1fe82fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a72bbb43689591c9d36e3bb45c2d4e688cf92682"
        },
        {
          "url": "https://git.kernel.org/stable/c/36723b28e3293047f087f4501f1ef4ead418dd84"
        },
        {
          "url": "https://git.kernel.org/stable/c/07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/82fc886e244c76fadf05ef1958aaf8815478ccde"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729"
        },
        {
          "url": "https://git.kernel.org/stable/c/18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc"
        }
      ],
      "title": "orangefs: keep the readdir entry size 64-bit in fill_from_part()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72033",
    "datePublished": "2026-08-15T05:51:55.102Z",
    "dateReserved": "2026-08-09T03:40:39.901Z",
    "dateUpdated": "2026-08-17T05:39:36.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72033",
      "date": "2026-09-21",
      "epss": "0.00739",
      "percentile": "0.52656"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/orangefs/dir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1679780f482feeb82acb5995587d4fb1d1fe82fd",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a72bbb43689591c9d36e3bb45c2d4e688cf92682",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "36723b28e3293047f087f4501f1ef4ead418dd84",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "82fc886e244c76fadf05ef1958aaf8815478ccde",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc",
                    "status": "affected",
                    "version": "480e3e532e31666a18520a7964bb4095d7a16b9a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/orangefs/dir.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: keep the readdir entry size 64-bit in fill_from_part()\n\nfill_from_part() computes the size of a directory entry in size_t but\nstores it in a __u32. An entry length near U32_MAX wraps it to a small\nvalue, bypasses the bounds check, and is then used to index the entry,\nreading far past the directory part -- an out-of-bounds read that oopses\nthe kernel.\n\nCompute the size as a u64 so it cannot truncate; the bounds check then\nrejects the entry. The trailer is supplied by the userspace client."
          }
        ],
        "id": "CVE-2026-72033",
        "lastModified": "2026-08-17T06:18:01.060",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:12.247",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1679780f482feeb82acb5995587d4fb1d1fe82fd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/36723b28e3293047f087f4501f1ef4ead418dd84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/82fc886e244c76fadf05ef1958aaf8815478ccde"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a72bbb43689591c9d36e3bb45c2d4e688cf92682"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T09:53:35+00:00",
      "cve": "CVE-2026-72033",
      "id": "CVE-2026-72033",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: orangefs: keep the readdir entry size 64-bit in fill_from_part()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72033.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:31:12Z",
      "cve": "CVE-2026-72033",
      "id": "CVE-2026-72033",
      "initial_release_date": "2026-08-18T16:55:10Z",
      "product_status:known_affected": "356",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72033",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72033.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.