EUVD-2026-76403
GHSA-3799-qp69-xpqm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and low-privilege write to orangefs debug interface required; heap overflow enables full kernel memory read/write/availability impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
orangefs: skip leading spaces before parsing client debug masks
orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " "), but then parses the keyword with %s. The %s conversion skips leading whitespace, while strcspn() does not.
If a client debug entry starts with a space, the allocation can be sized for an empty keyword while sscanf() copies the following non-empty token. This can write past the end of the allocated keyword buffer.
Skip leading spaces before computing the keyword length so the allocation matches the string parsed by sscanf().
AnalysisAI
Heap buffer overflow in the Linux kernel orangefs client debug-mask parser allows a local low-privileged attacker to corrupt kernel heap memory and potentially escalate privileges. The flaw originates in orangefs_prepare_cdm_array(), where buffer sizing via strcspn() and subsequent parsing via sscanf %s diverge in how they handle leading whitespace - a crafted debug mask entry prefixed with a space causes an undersized allocation that sscanf then overwrites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local shell access with at least low-privilege user credentials (PR:L); (2) the `orangefs` kernel module loaded and an OrangeFS filesystem client active on the host - this subsystem is absent in most general-purpose Linux deployments and is specific to HPC/parallel-filesystem environments; (3) write access to the orangefs client debug mask interface (typically a procfs or debugfs file exposed by the orangefs driver). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this class of flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a patched kernel release: Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, containing the fix for `orangefs_prepare_cdm_array()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, catalog all systems running the orangefs client and their current kernel versions to identify exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today