1. Home
  2. Vulnerabilities
  3. CVE-2026-72033
9.8
CRITICAL CVSS 3.1
CVE-2026-72033
orangefs: keep the readdir entry size 64-bit in fill_from_part()
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill_from_part() fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel. Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.

Details
INFO

Published Date :

Aug. 15, 2026, 6:21 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

Yes !

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-72033 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Ensure directory entry size is handled as 64-bit to prevent out-of-bounds reads.
  • Compute directory entry size as u64.
  • Apply bounds check to reject large entries.
  • Update the Linux kernel to the latest version.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-72033.

URL Resource
https://git.kernel.org/stable/c/07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9
https://git.kernel.org/stable/c/1679780f482feeb82acb5995587d4fb1d1fe82fd
https://git.kernel.org/stable/c/18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc
https://git.kernel.org/stable/c/36723b28e3293047f087f4501f1ef4ead418dd84
https://git.kernel.org/stable/c/82fc886e244c76fadf05ef1958aaf8815478ccde
https://git.kernel.org/stable/c/a72bbb43689591c9d36e3bb45c2d4e688cf92682
https://git.kernel.org/stable/c/e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729
https://git.kernel.org/stable/c/fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72033 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72033 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72033 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-72033 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '1679780f482feeb82acb5995587d4fb1d1fe82fd', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'a72bbb43689591c9d36e3bb45c2d4e688cf92682', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '36723b28e3293047f087f4501f1ef4ead418dd84', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '82fc886e244c76fadf05ef1958aaf8815478ccde', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc', 'versionType': 'git'}], 'programFiles': ['fs/orangefs/dir.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/orangefs/dir.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '1679780f482feeb82acb5995587d4fb1d1fe82fd', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'a72bbb43689591c9d36e3bb45c2d4e688cf92682', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '36723b28e3293047f087f4501f1ef4ead418dd84', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '82fc886e244c76fadf05ef1958aaf8815478ccde', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc', 'versionType': 'git'}], 'programFiles': ['fs/orangefs/dir.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/orangefs/dir.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '1679780f482feeb82acb5995587d4fb1d1fe82fd', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'a72bbb43689591c9d36e3bb45c2d4e688cf92682', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '36723b28e3293047f087f4501f1ef4ead418dd84', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '82fc886e244c76fadf05ef1958aaf8815478ccde', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': 'e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729', 'versionType': 'git'}, {'status': 'affected', 'version': '480e3e532e31666a18520a7964bb4095d7a16b9a', 'lessThan': '18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc', 'versionType': 'git'}], 'programFiles': ['fs/orangefs/dir.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/orangefs/dir.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill_from_part() fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel. Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.
    Added Reference https://git.kernel.org/stable/c/07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9
    Added Reference https://git.kernel.org/stable/c/1679780f482feeb82acb5995587d4fb1d1fe82fd
    Added Reference https://git.kernel.org/stable/c/18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc
    Added Reference https://git.kernel.org/stable/c/36723b28e3293047f087f4501f1ef4ead418dd84
    Added Reference https://git.kernel.org/stable/c/82fc886e244c76fadf05ef1958aaf8815478ccde
    Added Reference https://git.kernel.org/stable/c/a72bbb43689591c9d36e3bb45c2d4e688cf92682
    Added Reference https://git.kernel.org/stable/c/e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729
    Added Reference https://git.kernel.org/stable/c/fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact