CVE-2026-72033

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the orangefs component. The fill from part() function calculates the size of a directory entry using size t but stores the result in a u32 variable. If an entry length is close to U32 MAX, it wraps around to a small value, allowing it to bypass bounds checks. This value is then used to index the entry, causing the kernel to read memory far beyond the directory part, which leads to a kernel oops (a system crash or error). The issue is triggered by a trailer supplied by the userspace client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.