Skip to main content

Linux Kernel EUVDEUVD-2026-58991

| CVE-2026-72033 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-36xg-4chx-xvwp
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.1 MEDIUM

Local OrangeFS mount with attacker-influenced userspace client trailer (AV:L, PR:L); impact is kernel oops (A:H) and limited OOB kernel read (C:L), no integrity loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:40 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

orangefs: keep the readdir entry size 64-bit in fill_from_part()

fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel.

Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.

AnalysisAI

Kernel memory disclosure and denial-of-service in the Linux kernel OrangeFS client affects systems mounting OrangeFS parallel filesystems, where fill_from_part() truncates a 64-bit directory-entry length into a __u32. An entry length near U32_MAX wraps to a small value that slips past the bounds check and is then used to index the directory part, causing an out-of-bounds read that oopses the kernel. The malformed trailer is supplied by the userspace OrangeFS client, and there is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and this is not in CISA KEV. Note: the input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) conflicts with the description, which describes a local, client-supplied-data OOB read rather than remote unauthenticated code execution.

Technical ContextAI

OrangeFS is a distributed/parallel network filesystem (formerly PVFS2) used mainly in HPC and research storage clusters; its Linux kernel module cooperates with a userspace client daemon that marshals directory listings back to the kernel. In fs/orangefs, fill_from_part() parses readdir results by computing each entry's size in a native size_t but storing it into a fixed-width __u32 field. This is an integer truncation defect (CWE-190) leading to an out-of-bounds read (CWE-125): when the computed length approaches U32_MAX, the high bits are discarded, the truncated value passes the length/bounds validation, and the kernel then walks past the end of the directory buffer. The 'trailer' containing the crafted entry length originates from the userspace OrangeFS client, so the kernel is trusting attacker-influenceable data supplied across the kernel/userspace boundary.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (fix also in 7.2-rc2), matching your kernel series; the fix changes fill_from_part() to compute the entry size as a u64 so it cannot truncate and the bounds check correctly rejects oversized entries. Apply the corresponding commit from https://git.kernel.org/stable/c/ (e.g. a72bbb43689591c9d36e3bb45c2d4e688cf92682) if you maintain custom kernels. As a compensating control where patching is not immediately possible, unload/blacklist the OrangeFS kernel module (modprobe -r orangefs; add to /etc/modprobe.d blacklist) and unmount OrangeFS volumes - trade-off: this disables OrangeFS access entirely, unacceptable on HPC nodes that depend on it. Where OrangeFS must stay mounted, restrict which hosts/users can run or reach the userspace OrangeFS client daemon and ensure the client binary and its trailer-generating path come only from trusted, patched sources, since the malformed trailer originates there. See EUVD-2026-58991 and the git.kernel.org references for exact commit mapping.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-58991 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy