CVE-2026-72033

A flaw was found in OrangeFS, a file system within the Linux kernel. An integer overflow occurs in the fill_from_part() function when calculating the size of a directory entry. This happens because the size is computed as a 64-bit value but stored as a 32-bit value, allowing a large entry length to wrap around. A local attacker or malicious userspace client can exploit this by providing a specially crafted directory entry, leading to an out-of-bounds read and a kernel crash.

This vulnerability is rated as Moderate severity because exploitation is limited to a local kernel denial of service and requires an environment actively running the OrangeFS file system. The out-of-bounds memory read triggers a kernel crash without granting arbitrary code execution or compromising confidential system data. Additionally, Red Hat Enterprise Linux kernels do not enable or ship OrangeFS support by default, ensuring standard installations are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.