CVE-2026-72033 orangefs: keep the readdir entry size 64-bit in fill_from_part()
A 32-bit truncation in OrangeFS readdir handling causes an out-of-bounds read, leading to a kernel crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72033?
CVE-2026-72033 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
orangefs: keep the readdir entry size 64-bit in fill_from_part()
fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel.
Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.
Which versions are affected by CVE-2026-72033?
How do I fix CVE-2026-72033?
Apply the vendor's patch.
Is CVE-2026-72033 being exploited?
There is no known exploitation of CVE-2026-72033 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72033, DEBIAN-CVE-2026-72033, GHSA-36xg-4chx-xvwp, UBUNTU-CVE-2026-72033.